OVAL check for unauthorized suig/sgid files
Steve Grubb
sgrubb at redhat.com
Mon Jul 15 17:40:58 UTC 2013
On Monday, July 15, 2013 09:44:23 AM Jeffrey Blank wrote:
> Yes, that probably makes sense.
> There's certainly room for Rules of both styles.
>
> Until we figure out how to make OVAL do that, we'll stick with your
> whitelist.
>
> Also, I added two setuid binaries to the list -- both were from abrt,
> and installed by default on my workstation. Hopefully you are okay with
> setuids from any package in RHEL.
As I recall from USGCB, we defined authorised setuid/gid files as packaged in an
rpm that was signed with Red Hat's key and having unchanged permissions. We
had to get specific tests into OVAL 5.10 just to make this work.Wouldn't we
just reuse the OVAL from USGCB?
-Steve
More information about the scap-security-guide
mailing list