[PATCH 25/31] Linked shared/file_permissions_library_dirs.xml to
Shawn Wells
shawn at redhat.com
Fri Dec 27 23:28:33 UTC 2013
-------------- next part --------------
>From f0531710a4cbdcef1d74569b0b5e1521379f8ce7 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 27 Dec 2013 02:45:37 -0500
Subject: [PATCH 25/31] Linked shared/file_permissions_library_dirs.xml to
RHEL6/7
- Removed historical RHEL6 OVAL in favor of Jan's new regex's
- Tested on RHEL6 & RHEL7, updated CPE info, created symlinks
---
.../input/checks/file_permissions_library_dirs.xml | 137 +--------------------
.../input/checks/file_permissions_library_dirs.xml | 1 +
shared/oval/file_permissions_library_dirs.xml | 2 +
3 files changed, 4 insertions(+), 136 deletions(-)
mode change 100644 => 120000 RHEL/6/input/checks/file_permissions_library_dirs.xml
create mode 120000 RHEL/7/input/checks/file_permissions_library_dirs.xml
diff --git a/RHEL/6/input/checks/file_permissions_library_dirs.xml b/RHEL/6/input/checks/file_permissions_library_dirs.xml
deleted file mode 100644
index 0005b8c..0000000
--- a/RHEL/6/input/checks/file_permissions_library_dirs.xml
+++ /dev/null
@@ -1,136 +0,0 @@
-<def-group>
- <definition class="compliance" id="file_permissions_library_dirs" version="1">
- <metadata>
- <title>Verify that Shared Library Files Have Restrictive Permissions</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and objects therein, are not group-writable
- or world-writable.</description>
- <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
- </metadata>
- <criteria operator="AND">
- <criterion test_ref="test_perms_lib_dir" />
- <criterion test_ref="test_perms_lib64_dir" />
- <criterion test_ref="test_perms_usr_lib_dir" />
- <criterion test_ref="test_perms_usr_lib64_dir" />
- <criterion test_ref="test_perms_lib_files" />
- <criterion test_ref="test_perms_lib64_files" />
- <criterion test_ref="test_perms_usr_lib_files" />
- <criterion test_ref="test_perms_usr_lib64_files" />
- </criteria>
- </definition>
-
-<!-- /lib directory and file tests -->
- <unix:file_test check="all" check_existence="none_exist" comment="/lib directories go-w" id="test_perms_lib_dir" version="1">
- <unix:object object_ref="object_file_permissions_lib_dir" />
- </unix:file_test>
-
- <unix:file_test check="all" check_existence="none_exist" comment="/lib files go-w" id="test_perms_lib_files" version="1">
- <unix:object object_ref="object_file_permissions_lib_files" />
- </unix:file_test>
-
- <unix:file_object comment="/lib directories" id="object_file_permissions_lib_dir" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
- <unix:path operation="equals">/lib</unix:path>
- <unix:filename xsi:nil="true" />
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
- <filter action="exclude">state_symlink</filter>
- </unix:file_object>
-
- <unix:file_object comment="/lib files" id="object_file_permissions_lib_files" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
- <unix:path operation="equals">/lib</unix:path>
- <unix:filename operation="pattern match">^.*$</unix:filename>
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
- <filter action="exclude">state_symlink</filter>
- </unix:file_object>
-<!-- end /lib directory and file tests -->
-
-<!-- /lib64 directory and file tests -->
- <unix:file_test check="all" check_existence="none_exist" comment="/lib64 directories go-w" id="test_perms_lib64_dir" version="1">
- <unix:object object_ref="object_file_permissions_lib64_dir" />
- </unix:file_test>
-
- <unix:file_test check="all" check_existence="none_exist" comment="/lib64 files go-w" id="test_perms_lib64_files" version="1">
- <unix:object object_ref="object_file_permissions_lib64_files" />
- </unix:file_test>
-
- <unix:file_object comment="/lib64 directories" id="object_file_permissions_lib64_dir" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
- <unix:path operation="equals">/lib64</unix:path>
- <unix:filename xsi:nil="true" />
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
- <filter action="exclude">state_symlink</filter>
- </unix:file_object>
-
- <unix:file_object comment="/lib64 files" id="object_file_permissions_lib64_files" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
- <unix:path operation="equals">/lib64</unix:path>
- <unix:filename operation="pattern match">^.*$</unix:filename>
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
- <filter action="exclude">state_symlink</filter>
- </unix:file_object>
-<!-- /lib64 directory and file tests -->
-
-<!-- /usr/lib directory and file tests -->
- <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib directories go-w" id="test_perms_usr_lib_dir" version="1">
- <unix:object object_ref="object_file_permissions_usr_lib_dir" />
- </unix:file_test>
-
- <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib files go-w" id="test_perms_usr_lib_files" version="1">
- <unix:object object_ref="object_file_permissions_usr_lib_files" />
- </unix:file_test>
-
- <unix:file_object comment="/usr/lib directories" id="object_file_permissions_usr_lib_dir" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
- <unix:path operation="equals">/usr/lib</unix:path>
- <unix:filename xsi:nil="true" />
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
- <filter action="exclude">state_symlink</filter>
- </unix:file_object>
-
- <unix:file_object comment="/usr/lib files" id="object_file_permissions_usr_lib_files" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
- <unix:path operation="equals">/usr/lib</unix:path>
- <unix:filename operation="pattern match">^.*$</unix:filename>
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
- <filter action="exclude">state_symlink</filter>
- </unix:file_object>
-<!-- /usr/lib directory and file tests -->
-
-<!-- /usr/lib64 directory and file tests -->
- <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib64 directories go-w" id="test_perms_usr_lib64_dir" version="1">
- <unix:object object_ref="object_file_permissions_usr_lib64_dir" />
- </unix:file_test>
-
- <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib64 files go-w" id="test_perms_usr_lib64_files" version="1">
- <unix:object object_ref="object_file_permissions_usr_lib64_files" />
- </unix:file_test>
-
- <unix:file_object comment="/usr/lib64 directories" id="object_file_permissions_usr_lib64_dir" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
- <unix:path operation="equals">/usr/lib64</unix:path>
- <unix:filename xsi:nil="true" />
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
- <filter action="exclude">state_symlink</filter>
- </unix:file_object>
-
- <unix:file_object comment="/usr/lib64 files" id="object_file_permissions_usr_lib64_files" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
- <unix:path operation="equals">/usr/lib64</unix:path>
- <unix:filename operation="pattern match">^.*$</unix:filename>
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
- <filter action="exclude">state_symlink</filter>
- </unix:file_object>
-<!-- /usr/lib64 directory and file tests -->
-
- <unix:file_state id="state_symlink" version="1">
- <unix:type operation="equals">symbolic link</unix:type>
- </unix:file_state>
-
- <unix:file_state id="state_perms_nogroupwrite_noworldwrite" version="1" operator="OR">
- <unix:gwrite datatype="boolean">true</unix:gwrite>
- <unix:owrite datatype="boolean">true</unix:owrite>
- </unix:file_state>
-</def-group>
diff --git a/RHEL/6/input/checks/file_permissions_library_dirs.xml b/RHEL/6/input/checks/file_permissions_library_dirs.xml
new file mode 120000
index 0000000..ffcc554
--- /dev/null
+++ b/RHEL/6/input/checks/file_permissions_library_dirs.xml
@@ -0,0 +1 @@
+../../../../shared/oval/file_permissions_library_dirs.xml
\ No newline at end of file
diff --git a/RHEL/7/input/checks/file_permissions_library_dirs.xml b/RHEL/7/input/checks/file_permissions_library_dirs.xml
new file mode 120000
index 0000000..ffcc554
--- /dev/null
+++ b/RHEL/7/input/checks/file_permissions_library_dirs.xml
@@ -0,0 +1 @@
+../../../../shared/oval/file_permissions_library_dirs.xml
\ No newline at end of file
diff --git a/shared/oval/file_permissions_library_dirs.xml b/shared/oval/file_permissions_library_dirs.xml
index cce15a5..9c6dd98 100644
--- a/shared/oval/file_permissions_library_dirs.xml
+++ b/shared/oval/file_permissions_library_dirs.xml
@@ -4,6 +4,8 @@
<title>Verify that Shared Library Files Have Restrictive Permissions</title>
<affected family="unix">
<platform>Fedora 19</platform>
+ <platform>Red Hat Enterprise Linux 6</platform>
+ <platform>Red Hat Enterprise Linux 7</platform>
</affected>
<description>
Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
--
1.8.3.1
More information about the scap-security-guide
mailing list