Suggestion on the 'Ensure All Files Are Owned...' items

Shawn Wells shawn at redhat.com
Tue Jul 23 01:27:11 UTC 2013


On 7/19/13 1:52 PM, Andrew Gilmore wrote:
> I agree, I see false positives on my systems where the only output
> from a manual 'sudo find / -type f -perm o+w' is errors on /proc
> directories.
>
> Andrew
>
> On Thu, Jul 18, 2013 at 11:11 AM, Robert Sanders<rsanders at trustedcs.com>  wrote:
>> >I was wondering why the tests for 'Ensure all Files Are Owned by a User' and
>> >'Ensure all Files are Owned by a Group' kept on failing.  Drilling down it
>> >looks like the underlying find command being used is along the lines of :
>> >
>> >find PARTITION -xdev -nouser -print
>> >
>> >When I run this command manually I've had complaints that find can't read
>> >files in /proc.  Looking at the man page suggests this can be avoided by
>> >adding the '-ignore_readdir_race' option before the -xdev option.
>> >
>> >This change may need to be added for both SSG items 2.2.3.e and 2.2.3.f
>> >
>> >-Rob
>> >

Hmm. The OVAL spec is here (search for " == FileBehaviors =="):
http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/linux-definitions-schema.html

And our OVAL:
>   <unix:file_object comment="all local files"
>   id="obj_20022" version="1">
>     <unix:behaviors recurse="symlinks and directories" 
> recurse_file_system="local" />
>     <unix:path>/</unix:path>
>     <unix:filename operation="pattern match">.*</unix:filename>
>   </unix:file_object>

According to the spec, it should be possible to use 
recurse_file_system="defined", and use the unix:filename to create a 
regex that excludes /proc

Maura seems to have the best regex skills.... ;)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130722/0702649d/attachment-0001.html>


More information about the scap-security-guide mailing list