OVAL check for unauthorized suig/sgid files

Steve Grubb sgrubb at redhat.com
Mon Jul 15 17:40:58 UTC 2013


On Monday, July 15, 2013 09:44:23 AM Jeffrey Blank wrote:
> Yes, that probably makes sense.
> There's certainly room for Rules of both styles.
> 
> Until we figure out how to make OVAL do that, we'll stick with your
> whitelist.
> 
> Also, I added two setuid binaries to the list -- both were from abrt,
> and installed by default on my workstation.  Hopefully you are okay with
> setuids from any package in RHEL.

As I recall from USGCB, we defined authorised setuid/gid files as packaged in an 
rpm that was signed with Red Hat's key and having unchanged permissions. We 
had to get specific tests into OVAL 5.10 just to make this work.Wouldn't we 
just reuse the OVAL from USGCB?

-Steve


More information about the scap-security-guide mailing list