[PATCH 1/3] Created new OVAL template
Shawn Wells
shawn.d.wells at gmail.com
Sun Jul 7 06:48:18 UTC 2013
-------------- next part --------------
>From 7f03d70c2f0f6d478cc68a79b630b4b967319487 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 7 Jul 2013 02:18:37 -0400
Subject: [PATCH 1/3] Created new OVAL template: create_file_ownership_checks.py
- Existing file ownership not templated, and should be
- Existing XCCDF used various naming schemes, e.g. file_owner, file_ownership, userowner_,
standardizing on file_ownership_*
- Template uses existing file_dir_permissions.csv
[shawn at rhel6 templates]$ make permissions
./create_permission_checks.py file_dir_permissions.csv
./create_file_ownership_checks.py file_dir_permissions.csv
[shawn at rhel6 templates]$ ../testcheck.py output/file_ownership_*
Evaluating with OVAL tempfile : /tmp/file_ownership_boot_grub_grub.confatuGN6.xml
Definition oval:scap-security-guide.testing:def:104: true
Evaluation done.
Evaluating with OVAL tempfile : /tmp/file_ownership_etc_gshadowXfKBBO.xml
Definition oval:scap-security-guide.testing:def:108: true
Evaluation done.
Evaluating with OVAL tempfile : /tmp/file_ownership_etc_passwdjJnzt8.xml
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.
Evaluating with OVAL tempfile : /tmp/file_ownership_etc_shadowSl8n43.xml
Definition oval:scap-security-guide.testing:def:112: true
Evaluation done.
---
RHEL6/input/checks/templates/Makefile | 1 +
.../templates/create_file_ownership_checks.py | 38 ++++++++++++++++++++
.../input/checks/templates/template_file_ownership | 27 ++++++++++++++
3 files changed, 66 insertions(+), 0 deletions(-)
create mode 100755 RHEL6/input/checks/templates/create_file_ownership_checks.py
create mode 100644 RHEL6/input/checks/templates/template_file_ownership
diff --git a/RHEL6/input/checks/templates/Makefile b/RHEL6/input/checks/templates/Makefile
index 7c892b9..926ec93 100644
--- a/RHEL6/input/checks/templates/Makefile
+++ b/RHEL6/input/checks/templates/Makefile
@@ -13,6 +13,7 @@ kernel_modules:
permissions:
./create_permission_checks.py file_dir_permissions.csv
+ ./create_file_ownership_checks.py file_dir_permissions.csv
sysctls:
./create_sysctl_checks.py sysctl_values.csv
diff --git a/RHEL6/input/checks/templates/create_file_ownership_checks.py b/RHEL6/input/checks/templates/create_file_ownership_checks.py
new file mode 100755
index 0000000..77e2860
--- /dev/null
+++ b/RHEL6/input/checks/templates/create_file_ownership_checks.py
@@ -0,0 +1,38 @@
+#!/usr/bin/python
+
+import sys, csv, re
+
+def output_checkfile(fileinfo):
+ # get the items out of the list
+ objpath, objfilename, userid, groupid, fileperms = fileinfo
+
+ # convert directory path variable name to a format suitable for 'id' tags
+ objfullpath = re.sub('[-\/]', '_', objpath)
+
+ # open the template and perform the conversions
+ with open("template_file_ownership", 'r') as templatefile:
+ filestring = templatefile.read()
+ filestring = filestring.replace("OBJPATH", objpath)
+ filestring = filestring.replace("OBJFILENAME", objfilename)
+ filestring = filestring.replace("USERID", userid)
+ filestring = filestring.replace("OBJFULLPATH", objfullpath)
+ # write the check
+ with open("./output/file_ownership" + objfullpath + "_" + objfilename +".xml", 'wb+') as outputfile:
+ outputfile.write(filestring)
+ outputfile.close()
+
+def main():
+ if len(sys.argv) < 2:
+ print "Provide a CSV file containing lines of the format: sysctlvariable,sysctlvalue"
+ sys.exit(1)
+ with open(sys.argv[1], 'r') as f:
+ # put the CSV line's items into a list
+ sysctl_lines = csv.reader(f)
+ for line in sysctl_lines:
+ output_checkfile(line)
+
+ sys.exit(0)
+
+if __name__ == "__main__":
+ main()
+
diff --git a/RHEL6/input/checks/templates/template_file_ownership b/RHEL6/input/checks/templates/template_file_ownership
new file mode 100644
index 0000000..8462f56
--- /dev/null
+++ b/RHEL6/input/checks/templates/template_file_ownership
@@ -0,0 +1,27 @@
+<def-group>
+ <definition class="compliance" id="file_ownershipOBJFULLPATH_OBJFILENAME" version="1">
+ <metadata>
+ <title>Verify uid USERID owns OBJPATH/OBJFILENAME file</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The /etc/passwd file should be owned by UID USERID.</description>
+ </metadata>
+ <criteria>
+ <criterion test_ref="testOBJFULLPATH_OBJFILENAME_uid_USERID" />
+ </criteria>
+ </definition>
+ <unix:file_test check="all" check_existence="all_exist"
+ comment="Testing user ownership of OBJPATH/OBJFILENAME"
+ id="testOBJFULLPATH_OBJFILENAME_uid_USERID" version="1">
+ <unix:object object_ref="objOBJFULLPATH_OBJFILENAME_uid_USERID" />
+ <unix:state state_ref="stateOBJFULLPATH_OBJFILENAME_uid_USERID" />
+ </unix:file_test>
+ <unix:file_state id="stateOBJFULLPATH_OBJFILENAME_uid_USERID" version="1">
+ <unix:user_id datatype="int">USERID</unix:user_id>
+ </unix:file_state>
+ <unix:file_object comment="OBJPATH/OBJFILENAME uid check" id="objOBJFULLPATH_OBJFILENAME_uid_USERID" version="1">
+ <unix:path>OBJPATH</unix:path>
+ <unix:filename>OBJFILENAME</unix:filename>
+ </unix:file_object>
+</def-group>
--
1.7.1
More information about the scap-security-guide
mailing list