Suggestion on the 'Ensure All Files Are Owned...' items
Maura Dailey
maura at eclipse.ncsc.mil
Tue Jul 23 18:24:22 UTC 2013
That's about where I was going with it just now, actually (although I
was unsuccessfully trying something more complicated with the
password_test and password_object OVAL pieces), but do we have to solve
network user ids as well? Or do you think it is sufficient in this check
to just check local accounts?
- Maura Dailey
On 07/23/2013 02:19 PM, Steve Grubb wrote:
> On Tuesday, July 23, 2013 02:04:48 PM Maura Dailey wrote:
>> On 07/23/2013 01:23 PM, Gary Gapinski wrote:
>>> On 07/23/2013 01:17 PM, Maura Dailey wrote:
>>>> Does anyone actually have a way to "unown" or "ungroup own" a file for
>>>> testing purposes? I'd like to see if the uid shows up as 0 or as xsi:nil.
>>> chown <pick some unused uid> file
>>> chgrp <pick some unused gid> file
>> Huh, didn't realize that was all we were testing for. That makes it way
>> harder to test in OVAL, obviously, since the normal file test will
>> happily report whatever value it finds without checking if it's assigned
>> to a user or group.
> This test is correctly working in RHEL5 USGCB. There is a variable with local user ID's:
>
> <ind-def:textfilecontent54_object id="oval:gov.nist.usgcb.rhel:obj:200501" version="1">
> <ind-def:filepath>/etc/passwd</ind-def:filepath>
> <ind-def:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind-def:pattern>
> <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
> </ind-def:textfilecontent54_object>
>
> And this is used in another test:
> <unix-def:file_state id="oval:gov.nist.usgcb.rhel:ste:20050" version="1" comment="Files with a valid user id assigned">
> <unix-def:user_id datatype="int" var_check="at least one" var_ref="oval:gov.nist.usgcb.rhel:var:200501"/>
> </unix-def:file_state>
>
>
> which checks the results of recursing the local file system:
>
> <unix-def:file_object id="oval:gov.nist.usgcb.rhel:obj:20050" version="1" comment="all local files without a valid user assigned">
> <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
> <unix-def:path>/</unix-def:path>
> <unix-def:filename operation="pattern match">.*</unix-def:filename>
> <filter>oval:gov.nist.usgcb.rhel:ste:20050</filter>
> </unix-def:file_object>
>
> This was working in the past.
>
> -Steve
More information about the scap-security-guide
mailing list