[PATCH 2/2] new versions of unauth suid/sgid OVAL checks

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jul 15 02:39:56 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 .../checks/file_permissions_unauthorized_sgid.xml  |   60 ++++++++++++--
 .../checks/file_permissions_unauthorized_suid.xml  |   86 +++++++++++++++++--
 2 files changed, 128 insertions(+), 18 deletions(-)

diff --git a/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml b/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml
index 5f10e5d..36d40d5 100644
--- a/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml
+++ b/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml
@@ -1,31 +1,73 @@
 <def-group>
   <definition class="compliance" id="file_permissions_unauthorized_sgid" version="1">
     <metadata>
-      <title>Find Unauthorized SGID System Executables</title>
+      <title>Find setgid files system packages</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The sgid bit should be not set for all executable files.</description>
+      <description>All files with setgid should be owned by a base system package</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_file_permissions_unauthorized_sgid" />
+      <criterion comment="Check all setgid files" test_ref="check_setgid_files" />
     </criteria>
   </definition>
-  <!-- NOTE: It is impossible for an OVAL check to determine which sgid files are authorized or not. -->
-  <!-- This checks basically fails if any sgid files exist on the system. On a default RHEL6 install -->
-  <!-- there are a lot of sgid files. It will be up to the system administrator to determine which -->
-  <!-- sgid files are approved for use. -->
-  <unix:file_test check="all" check_existence="none_exist" comment="/etc/skel files mode 0644" id="test_file_permissions_unauthorized_sgid" version="1">
+
+  <unix:file_test check="all" check_existence="none_exist" comment="setgid files outside system RPMs" id="check_setgid_files" version="1">
     <unix:object object_ref="object_file_permissions_unauthorized_sgid" />
-    <unix:state state_ref="state_file_permissions_unauthorized_sgid" />
   </unix:file_test>
+
   <unix:file_object comment="files with sgid set" id="object_file_permissions_unauthorized_sgid" version="1">
     <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
     <unix:path operation="equals">/</unix:path>
     <unix:filename operation="pattern match">^.*$</unix:filename>
     <filter action="include">state_file_permissions_unauthorized_sgid</filter>
+    <filter action="exclude">state_sgid_whitelist</filter>
   </unix:file_object>
+
   <unix:file_state id="state_file_permissions_unauthorized_sgid" version="1">
     <unix:sgid datatype="boolean">true</unix:sgid>
   </unix:file_state>
+
+
+<!-- list of all setgid files included with base RHEL6 system -->
+    <unix:file_state id="state_sgid_whitelist" version="1">
+       <unix:filepath var_ref="var_sgid_whitelist" var_check="at least one" />
+    </unix:file_state>
+    <constant_variable id="var_sgid_whitelist" version="1" datatype="string" comment="sgid whitelist">
+                <value>/bin/cgexec</value>
+                <value>/sbin/netreport</value>
+                <value>/usr/bin/crontab</value>
+                <value>/usr/bin/gnomine</value>
+                <value>/usr/bin/iagno</value>
+                <value>/usr/bin/locate</value>
+                <value>/usr/bin/lockfile</value>
+                <value>/usr/bin/same-gnome</value>
+                <value>/usr/bin/screen</value>
+                <value>/usr/bin/ssh-agent</value>
+                <value>/usr/bin/wall</value>
+                <value>/usr/bin/write</value>
+                <value>/usr/lib64/vte/gnome-pty-helper</value>
+                <value>/usr/libexec/kde4/kdesud</value>
+                <value>/usr/libexec/utempter/utempter</value>
+                <value>/usr/lib/mailman/cgi-bin/admindb</value>
+                <value>/usr/lib/mailman/cgi-bin/admin</value>
+                <value>/usr/lib/mailman/cgi-bin/confirm</value>
+                <value>/usr/lib/mailman/cgi-bin/create</value>
+                <value>/usr/lib/mailman/cgi-bin/edithtml</value>
+                <value>/usr/lib/mailman/cgi-bin/listinfo</value>
+                <value>/usr/lib/mailman/cgi-bin/options</value>
+                <value>/usr/lib/mailman/cgi-bin/private</value>
+                <value>/usr/lib/mailman/cgi-bin/rmlist</value>
+                <value>/usr/lib/mailman/cgi-bin/roster</value>
+                <value>/usr/lib/mailman/cgi-bin/subscribe</value>
+                <value>/usr/lib/mailman/mail/mailman</value>
+                <value>/usr/lib/vte/gnome-pty-helper</value>
+                <value>/usr/sbin/lockdev</value>
+                <value>/usr/sbin/postdrop</value>
+                <value>/usr/sbin/postqueue</value>
+                <value>/usr/sbin/sendmail.sendmail</value>
+        </constant_variable>
+
+
+
 </def-group>
diff --git a/RHEL6/input/checks/file_permissions_unauthorized_suid.xml b/RHEL6/input/checks/file_permissions_unauthorized_suid.xml
index 14beff4..3a59897 100644
--- a/RHEL6/input/checks/file_permissions_unauthorized_suid.xml
+++ b/RHEL6/input/checks/file_permissions_unauthorized_suid.xml
@@ -1,31 +1,99 @@
 <def-group>
   <definition class="compliance" id="file_permissions_unauthorized_suid" version="1">
     <metadata>
-      <title>Find Unauthorized SUID System Executables</title>
+      <title>Find setuid files from system packages</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The suid bit should be not set for all files.</description>
+      <description>All files with setuid should be owned by a base system package</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_file_permissions_unauthorized_suid" />
+      <criterion comment="Check all setuid files" test_ref="check_setuid_files" />
     </criteria>
   </definition>
-  <!-- NOTE: It is impossible for an OVAL check to determine which suid files are authorized or not. -->
-  <!-- This checks basically fails if any suid files exist on the system. On a default RHEL6 install -->
-  <!-- there are a lot of suid files. It will be up to the system administrator to determine which -->
-  <!-- suid files are approved for use. -->
-  <unix:file_test check="all" check_existence="none_exist" comment="/etc/skel files mode 0644" id="test_file_permissions_unauthorized_suid" version="1">
+
+ <unix:file_test check="all" check_existence="none_exist" comment="setuid files outside system RPMs" id="check_setuid_files" version="1">
     <unix:object object_ref="object_file_permissions_unauthorized_suid" />
-    <unix:state state_ref="state_file_permissions_unauthorized_suid" />
   </unix:file_test>
+
   <unix:file_object comment="files with suid set" id="object_file_permissions_unauthorized_suid" version="1">
     <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
     <unix:path operation="equals">/</unix:path>
     <unix:filename operation="pattern match">^.*$</unix:filename>
     <filter action="include">state_file_permissions_unauthorized_suid</filter>
+    <filter action="exclude">state_suid_whitelist</filter>
   </unix:file_object>
+
   <unix:file_state id="state_file_permissions_unauthorized_suid" version="1">
     <unix:suid datatype="boolean">true</unix:suid>
   </unix:file_state>
+
+<!-- list of all setuid files included with base RHEL6 system -->
+   <unix:file_state id="state_suid_whitelist" version="1">
+      <unix:filepath var_ref="var_suid_whitelist" var_check="at least one" />
+   </unix:file_state>
+
+        <constant_variable id="var_suid_whitelist" version="1" datatype="string" comment="suid whitelist">
+                <value>/bin/fusermount</value>
+                <value>/bin/mount</value>
+                <value>/bin/ping6</value>
+                <value>/bin/ping</value>
+                <value>/bin/su</value>
+                <value>/bin/umount</value>
+                <value>/lib64/dbus-1/dbus-daemon-launch-helper</value>
+                <value>/lib/dbus-1/dbus-daemon-launch-helper</value>
+                <value>/sbin/mount.ecryptfs_private</value>
+                <value>/sbin/mount.nfs</value>
+                <value>/sbin/pam_timestamp_check</value>
+                <value>/sbin/unix_chkpwd</value>
+                <value>/usr/bin/abrt-action-install-debuginfo-to-abrt-cache</value>
+                <value>/usr/bin/at</value>
+                <value>/usr/bin/chage</value>
+                <value>/usr/bin/chfn</value>
+                <value>/usr/bin/chsh</value>
+                <value>/usr/bin/crontab</value>
+                <value>/usr/bin/gpasswd</value>
+                <value>/usr/bin/kgrantpty</value>
+                <value>/usr/bin/kpac_dhcp_helper</value>
+                <value>/usr/bin/ksu</value>
+                <value>/usr/bin/newgrp</value>
+                <value>/usr/bin/newrole</value>
+                <value>/usr/bin/passwd</value>
+                <value>/usr/bin/pkexec</value>
+                <value>/usr/bin/rcp</value>
+                <value>/usr/bin/rlogin</value>
+                <value>/usr/bin/rsh</value>
+                <value>/usr/bin/sperl5.10.1</value>
+                <value>/usr/bin/staprun</value>
+                <value>/usr/bin/sudoedit</value>
+                <value>/usr/bin/sudo</value>
+                <value>/usr/bin/Xorg</value>
+                <value>/usr/lib64/amanda/calcsize</value>
+                <value>/usr/lib64/amanda/dumper</value>
+                <value>/usr/lib64/amanda/killpgrp</value>
+                <value>/usr/lib64/amanda/planner</value>
+                <value>/usr/lib64/amanda/rundump</value>
+                <value>/usr/lib64/amanda/runtar</value>
+                <value>/usr/lib64/nspluginwrapper/plugin-config</value>
+                <value>/usr/lib/amanda/calcsize</value>
+                <value>/usr/lib/amanda/dumper</value>
+                <value>/usr/lib/amanda/killpgrp</value>
+                <value>/usr/lib/amanda/planner</value>
+                <value>/usr/lib/amanda/rundump</value>
+                <value>/usr/lib/amanda/runtar</value>
+                <value>/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache</value>
+                <value>/usr/libexec/spice-gtk-x86_64/spice-client-glib-usb-acl-helper</value>
+                <value>/usr/libexec/mc/cons.saver</value>
+                <value>/usr/libexec/openssh/ssh-keysign</value>
+                <value>/usr/libexec/polkit-1/polkit-agent-helper-1</value>
+                <value>/usr/libexec/pt_chown</value>
+                <value>/usr/libexec/pulse/proximity-helper</value>
+                <value>/usr/lib/nspluginwrapper/plugin-config</value>
+                <value>/usr/sbin/amcheck</value>
+                <value>/usr/sbin/seunshare</value>
+                <value>/usr/sbin/suexec</value>
+                <value>/usr/sbin/userhelper</value>
+                <value>/usr/sbin/usernetctl</value>
+        </constant_variable>
+
 </def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list