[PATCH 26/31] Linked shared/file_ownership_library_dirs to RHEL6 &

Shawn Wells shawn at redhat.com
Fri Dec 27 23:28:44 UTC 2013


-------------- next part --------------
>From 0591c82b3c59140278187a7dbf7511985b895f52 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 27 Dec 2013 02:48:08 -0500
Subject: [PATCH 26/31] Linked shared/file_ownership_library_dirs to RHEL6 &
 RHEL7

- Tested on RHEL6/7, updated CPE, created symlinks

- Removed old RHEL6 OVAL content in favor of Jan's w/new regex
---
 .../6/input/checks/file_ownership_library_dirs.xml | 140 +--------------------
 .../7/input/checks/file_ownership_library_dirs.xml |   1 +
 shared/oval/file_ownership_library_dirs.xml        |   2 +
 3 files changed, 4 insertions(+), 139 deletions(-)
 mode change 100644 => 120000 RHEL/6/input/checks/file_ownership_library_dirs.xml
 create mode 120000 RHEL/7/input/checks/file_ownership_library_dirs.xml

diff --git a/RHEL/6/input/checks/file_ownership_library_dirs.xml b/RHEL/6/input/checks/file_ownership_library_dirs.xml
deleted file mode 100644
index e3e66d2..0000000
--- a/RHEL/6/input/checks/file_ownership_library_dirs.xml
+++ /dev/null
@@ -1,139 +0,0 @@
-<def-group>
-  <definition class="compliance" id="file_ownership_library_dirs" version="1">
-    <metadata>
-      <title>Verify that Shared Library Files Have Root Ownership</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and objects therein, are owned by root</description>
-      <reference source="swells" ref_id="20130914" ref_url="test_attestation" />
-    </metadata>
-    <criteria operator="AND">
-      <criterion test_ref="test_ownership_lib_dir" />
-      <criterion test_ref="test_ownership_lib64_dir" />
-      <criterion test_ref="test_ownership_usr_lib_dir" />
-      <criterion test_ref="test_ownership_usr_lib64_dir" />
-      <criterion test_ref="test_ownership_lib_modules_dir" />
-      <criterion test_ref="test_ownership_lib_files" />
-      <criterion test_ref="test_ownership_lib64_files" />
-      <criterion test_ref="test_ownership_usr_lib_files" />
-      <criterion test_ref="test_ownership_usr_lib64_files" />
-      <criterion test_ref="test_ownership_lib_modules_files" />
-    </criteria>
-  </definition>
-
-  <unix:file_test  check="all" check_existence="none_exist" comment="/lib directories uid root" id="test_ownership_lib_dir" version="1">
-    <unix:object object_ref="file_ownership_object_lib_dir" />
-  </unix:file_test>
-
-  <unix:file_test  check="all" check_existence="none_exist" comment="/lib files uid root" id="test_ownership_lib_files" version="1">
-    <unix:object object_ref="object_file_ownership_lib_files" />
-  </unix:file_test>
-
-  <unix:file_object comment="/lib directories" id="file_ownership_object_lib_dir" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/lib</unix:path>
-    <unix:filename xsi:nil="true" />
-    <filter action="include">state_owner_not_root</filter>
-  </unix:file_object>
-
-  <unix:file_object comment="/lib files" id="object_file_ownership_lib_files" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/lib</unix:path>
-    <unix:filename operation="pattern match">^.*$</unix:filename>
-   <filter action="include">state_owner_not_root</filter>
-  </unix:file_object>
-
-  <unix:file_test  check="all" check_existence="none_exist" comment="/lib64 directories uid root" id="test_ownership_lib64_dir" version="1">
-    <unix:object object_ref="object_file_ownership_lib64_dir" />
-  </unix:file_test>
-
-  <unix:file_test  check="all" check_existence="none_exist" comment="/lib64 files uid root" id="test_ownership_lib64_files" version="1">
-    <unix:object object_ref="object_file_ownership_lib64_files" />
-  </unix:file_test>
-
-  <unix:file_object comment="/lib64 directories" id="object_file_ownership_lib64_dir" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/lib64</unix:path>
-    <unix:filename xsi:nil="true" />
-    <filter action="include">state_owner_not_root</filter>
-  </unix:file_object>
-
-  <unix:file_object comment="/lib64 files" id="object_file_ownership_lib64_files" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/lib64</unix:path>
-    <unix:filename operation="pattern match">^.*$</unix:filename>
-    <filter action="include">state_owner_not_root</filter>
-  </unix:file_object>
-
-  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/lib directories uid root" id="test_ownership_usr_lib_dir" version="1">
-    <unix:object object_ref="object_file_ownership_usr_lib_dir" />
-  </unix:file_test>
-
-  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/lib files uid root" id="test_ownership_usr_lib_files" version="1">
-    <unix:object object_ref="object_file_ownership_usr_lib_files" />
-  </unix:file_test>
-
-  <unix:file_object comment="/usr/lib directories" id="object_file_ownership_usr_lib_dir" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/usr/lib</unix:path>
-    <unix:filename xsi:nil="true" />
-	<filter action="include">state_owner_not_root</filter>
-  </unix:file_object>
-
-  <unix:file_object comment="/usr/lib files" id="object_file_ownership_usr_lib_files" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/usr/lib</unix:path>
-    <unix:filename operation="pattern match">^.*$</unix:filename>
-    <filter action="include">state_owner_not_root</filter>
-  </unix:file_object>  
-
-  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/lib64 directories uid root" id="test_ownership_usr_lib64_dir" version="1">
-    <unix:object object_ref="object_file_ownership_usr_lib64_dir" />
-  </unix:file_test>
-
-  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/lib64 files uid root" id="test_ownership_usr_lib64_files" version="1">
-    <unix:object object_ref="object_file_ownership_usr_lib64_files" />
-  </unix:file_test>
-
-  <unix:file_object comment="/usr/lib64 directories" id="object_file_ownership_usr_lib64_dir" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/usr/lib64</unix:path>
-    <unix:filename xsi:nil="true" />
-	<filter action="include">state_owner_not_root</filter>
-  </unix:file_object>
-
-  <unix:file_object comment="/usr/lib64 files" id="object_file_ownership_usr_lib64_files" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/usr/lib64</unix:path>
-    <unix:filename operation="pattern match">^.*$</unix:filename>
-    <filter action="include">state_owner_not_root</filter>
-  </unix:file_object>
-
-  <unix:file_test  check="all" check_existence="none_exist" comment="/lib/modules directories uid root" id="test_ownership_lib_modules_dir" version="1">
-    <unix:object object_ref="object_file_ownership_lib_modules" />
-  </unix:file_test>
-
-  <unix:file_test  check="all" check_existence="none_exist" comment="/lib/modules files uid root" id="test_ownership_lib_modules_files" version="1">
-    <unix:object object_ref="object_file_ownership_lib_modules_files" />
-  </unix:file_test>
-
-  <unix:file_object comment="/lib/modules directories" id="object_file_ownership_lib_modules" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/lib/modules</unix:path>
-    <unix:filename xsi:nil="true" />
-   <filter action="include">state_owner_not_root</filter>
-  </unix:file_object>
-
-  <unix:file_object comment="/lib/modules files" id="object_file_ownership_lib_modules_files" version="1">
-    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/lib/modules</unix:path>
-    <unix:filename operation="pattern match">^.*$</unix:filename>
-    <filter action="include">state_owner_not_root</filter>
-  </unix:file_object>
-
-  <unix:file_state id="state_owner_not_root" version="1" operator="OR">
-<!--    <unix:group_id datatype="int" operation="not equal">0</unix:group_id> -->
-    <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
-  </unix:file_state>
-</def-group>
diff --git a/RHEL/6/input/checks/file_ownership_library_dirs.xml b/RHEL/6/input/checks/file_ownership_library_dirs.xml
new file mode 120000
index 0000000..661b287
--- /dev/null
+++ b/RHEL/6/input/checks/file_ownership_library_dirs.xml
@@ -0,0 +1 @@
+../../../../shared/oval/file_ownership_library_dirs.xml
\ No newline at end of file
diff --git a/RHEL/7/input/checks/file_ownership_library_dirs.xml b/RHEL/7/input/checks/file_ownership_library_dirs.xml
new file mode 120000
index 0000000..661b287
--- /dev/null
+++ b/RHEL/7/input/checks/file_ownership_library_dirs.xml
@@ -0,0 +1 @@
+../../../../shared/oval/file_ownership_library_dirs.xml
\ No newline at end of file
diff --git a/shared/oval/file_ownership_library_dirs.xml b/shared/oval/file_ownership_library_dirs.xml
index 09c408e..3343999 100644
--- a/shared/oval/file_ownership_library_dirs.xml
+++ b/shared/oval/file_ownership_library_dirs.xml
@@ -4,6 +4,8 @@
       <title>Verify that Shared Library Files Have Root Ownership</title>
       <affected family="unix">
         <platform>Fedora 19</platform>
+        <platform>Red Hat Enterprise Linux 6</platform>
+        <platform>Red Hat Enterprise Linux 7</platform>
       </affected>
       <description>
         Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
-- 
1.8.3.1



More information about the scap-security-guide mailing list