OVAL check for unauthorized suig/sgid files

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jul 15 13:44:23 UTC 2013


Yes, that probably makes sense.
There's certainly room for Rules of both styles.

Until we figure out how to make OVAL do that, we'll stick with your
whitelist.

Also, I added two setuid binaries to the list -- both were from abrt,
and installed by default on my workstation.  Hopefully you are okay with
setuids from any package in RHEL.

Thanks,
Jeff






On 07/15/2013 05:34 AM, Rui Pedro Bernardino wrote:
> Hi Jeffrey,
> 
>  
> 
> I also dislike the hardcoded list but I really cannot think of another
> way to implement ‘no suid/sgid outside core system’. Just checking ‘no
> unpackaged suid/sgid’ doesn’t work for me: I don’t want to trust 3^rd
> party packages and I cannot “push” that trust into our customers for
> which we integrate and develop RPM packaged solutions.
> 
>  
> 
> Perhaps this constitutes a different rule, I don’t know.
> 
>  
> 
> Thanks
> 
>  
> 
> --
> 
> Rui Pedro Bernardino
> 
> CTE2/Tecnologias e Desenvolvimento
> 
> PT Inovação
> 
>  
> 
> *From:*scap-security-guide-bounces at lists.fedorahosted.org
> [mailto:scap-security-guide-bounces at lists.fedorahosted.org] *On Behalf
> Of *Jeffrey Blank
> *Sent:* domingo, 14 de Julho de 2013 23:04
> *To:* scap-security-guide at lists.fedorahosted.org
> *Subject:* Re: OVAL check for unauthorized suig/sgid files
> 
>  
> 
> Thanks Rui!  This raises an important question about how to handle
> setuid/setgid programs. 
> 
>  
> 
> Your OVAL includes a hardcoded list of setuid/setgid programs included
> with RHEL.
> 
> However, this could change with each update of RHEL, or with every
> installation of 3rd party software. 
> 
>  
> 
> A better approach might be (as the text in XCCDF suggests) to see if
> each setuid or setgid program is included a part of an RPM package.
> 
>  
> 
> This would address the problems of:
> 
> 1) installation of unpackaged software
> 
> 2) admins flipping a setuid bit on a program (accidental or intentional
> misconfiguration)
> 
>  
> 
> (The threat of malicious software is not addressed by this check in any
> form.)
> 
>  
> 
> Thoughts?
> 
> Let me see if I can create OVAL to accomplish that...
> 
>  
> 
>  
> 
> On Mon, Jul 8, 2013 at 10:16 AM, Rui Pedro Bernardino
> <rui-p-bernardino at ptinovacao.pt <mailto:rui-p-bernardino at ptinovacao.pt>>
> wrote:
> 
> Hi,
> 
> I found that the 'file_permissions_unauthorized_suid/sgid' checks were
> too important to always fail, so I picked up Open SCAP's and adapted the
> check to SSG.
> 
> It works for me, hope you find it useful.
> 
> 
> Regards
> 
> --
> Rui Pedro Bernardino
> CTE2/Tecnologias e Desenvolvimento
> PT Inovação
> 
> 
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> <mailto:scap-security-guide at lists.fedorahosted.org>
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 
>  
> 
> 
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list