[PATCH 1/3] Created new OVAL template

Shawn Wells shawn.d.wells at gmail.com
Sun Jul 7 06:48:18 UTC 2013


-------------- next part --------------
>From 7f03d70c2f0f6d478cc68a79b630b4b967319487 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 7 Jul 2013 02:18:37 -0400
Subject: [PATCH 1/3] Created new OVAL template: create_file_ownership_checks.py
 - Existing file ownership not templated, and should be
 - Existing XCCDF used various naming schemes, e.g. file_owner, file_ownership, userowner_,
   standardizing on file_ownership_*
 - Template uses existing file_dir_permissions.csv

[shawn at rhel6 templates]$ make permissions
./create_permission_checks.py file_dir_permissions.csv
./create_file_ownership_checks.py file_dir_permissions.csv

[shawn at rhel6 templates]$ ../testcheck.py output/file_ownership_*
Evaluating with OVAL tempfile : /tmp/file_ownership_boot_grub_grub.confatuGN6.xml
Definition oval:scap-security-guide.testing:def:104: true
Evaluation done.
Evaluating with OVAL tempfile : /tmp/file_ownership_etc_gshadowXfKBBO.xml
Definition oval:scap-security-guide.testing:def:108: true
Evaluation done.
Evaluating with OVAL tempfile : /tmp/file_ownership_etc_passwdjJnzt8.xml
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.
Evaluating with OVAL tempfile : /tmp/file_ownership_etc_shadowSl8n43.xml
Definition oval:scap-security-guide.testing:def:112: true
Evaluation done.
---
 RHEL6/input/checks/templates/Makefile              |    1 +
 .../templates/create_file_ownership_checks.py      |   38 ++++++++++++++++++++
 .../input/checks/templates/template_file_ownership |   27 ++++++++++++++
 3 files changed, 66 insertions(+), 0 deletions(-)
 create mode 100755 RHEL6/input/checks/templates/create_file_ownership_checks.py
 create mode 100644 RHEL6/input/checks/templates/template_file_ownership

diff --git a/RHEL6/input/checks/templates/Makefile b/RHEL6/input/checks/templates/Makefile
index 7c892b9..926ec93 100644
--- a/RHEL6/input/checks/templates/Makefile
+++ b/RHEL6/input/checks/templates/Makefile
@@ -13,6 +13,7 @@ kernel_modules:
 
 permissions:
 	./create_permission_checks.py file_dir_permissions.csv
+	./create_file_ownership_checks.py file_dir_permissions.csv
 
 sysctls:
 	./create_sysctl_checks.py sysctl_values.csv
diff --git a/RHEL6/input/checks/templates/create_file_ownership_checks.py b/RHEL6/input/checks/templates/create_file_ownership_checks.py
new file mode 100755
index 0000000..77e2860
--- /dev/null
+++ b/RHEL6/input/checks/templates/create_file_ownership_checks.py
@@ -0,0 +1,38 @@
+#!/usr/bin/python
+
+import sys, csv, re
+
+def output_checkfile(fileinfo):
+    # get the items out of the list
+    objpath, objfilename, userid, groupid, fileperms = fileinfo
+
+    # convert directory path variable name to a format suitable for 'id' tags
+    objfullpath = re.sub('[-\/]', '_', objpath)
+
+    # open the template and perform the conversions
+    with open("template_file_ownership", 'r') as templatefile:
+        filestring = templatefile.read()
+        filestring = filestring.replace("OBJPATH", objpath)
+        filestring = filestring.replace("OBJFILENAME", objfilename)
+        filestring = filestring.replace("USERID", userid)
+        filestring = filestring.replace("OBJFULLPATH", objfullpath)
+        # write the check
+        with open("./output/file_ownership" + objfullpath + "_" + objfilename +".xml", 'wb+') as outputfile:
+            outputfile.write(filestring)
+            outputfile.close()
+
+def main():
+    if len(sys.argv) < 2:
+        print "Provide a CSV file containing lines of the format: sysctlvariable,sysctlvalue"
+        sys.exit(1)
+    with open(sys.argv[1], 'r') as f:
+        # put the CSV line's items into a list
+        sysctl_lines = csv.reader(f)
+        for line in sysctl_lines:
+            output_checkfile(line)
+
+    sys.exit(0)
+
+if __name__ == "__main__":
+    main()
+
diff --git a/RHEL6/input/checks/templates/template_file_ownership b/RHEL6/input/checks/templates/template_file_ownership
new file mode 100644
index 0000000..8462f56
--- /dev/null
+++ b/RHEL6/input/checks/templates/template_file_ownership
@@ -0,0 +1,27 @@
+<def-group>
+  <definition class="compliance" id="file_ownershipOBJFULLPATH_OBJFILENAME" version="1">
+    <metadata>
+      <title>Verify uid USERID owns OBJPATH/OBJFILENAME file</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The /etc/passwd file should be owned by UID USERID.</description>
+    </metadata>
+    <criteria>
+      <criterion test_ref="testOBJFULLPATH_OBJFILENAME_uid_USERID" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="all_exist"
+    comment="Testing user ownership of OBJPATH/OBJFILENAME"
+    id="testOBJFULLPATH_OBJFILENAME_uid_USERID" version="1">
+    <unix:object object_ref="objOBJFULLPATH_OBJFILENAME_uid_USERID" />
+    <unix:state state_ref="stateOBJFULLPATH_OBJFILENAME_uid_USERID" />
+  </unix:file_test>
+  <unix:file_state id="stateOBJFULLPATH_OBJFILENAME_uid_USERID" version="1">
+    <unix:user_id datatype="int">USERID</unix:user_id>
+  </unix:file_state>
+  <unix:file_object comment="OBJPATH/OBJFILENAME uid check" id="objOBJFULLPATH_OBJFILENAME_uid_USERID" version="1">
+    <unix:path>OBJPATH</unix:path>
+    <unix:filename>OBJFILENAME</unix:filename>
+  </unix:file_object>
+</def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list