Suggestion on the 'Ensure All Files Are Owned...' items

Maura Dailey maura at eclipse.ncsc.mil
Tue Jul 23 18:24:22 UTC 2013


That's about where I was going with it just now, actually (although I 
was unsuccessfully trying something more complicated with the 
password_test and password_object OVAL pieces), but do we have to solve 
network user ids as well? Or do you think it is sufficient in this check 
to just check local accounts?

- Maura Dailey

On 07/23/2013 02:19 PM, Steve Grubb wrote:
> On Tuesday, July 23, 2013 02:04:48 PM Maura Dailey wrote:
>> On 07/23/2013 01:23 PM, Gary Gapinski wrote:
>>> On 07/23/2013 01:17 PM, Maura Dailey wrote:
>>>> Does anyone actually have a way to "unown" or "ungroup own" a file for
>>>> testing purposes? I'd like to see if the uid shows up as 0 or as xsi:nil.
>>> chown <pick some unused uid> file
>>> chgrp <pick some unused gid> file
>> Huh, didn't realize that was all we were testing for. That makes it way
>> harder to test in OVAL, obviously, since the normal file test will
>> happily report whatever value it finds without checking if it's assigned
>> to a user or group.
> This test is correctly working in RHEL5 USGCB. There is a variable with local user ID's:
>
>                  <ind-def:textfilecontent54_object id="oval:gov.nist.usgcb.rhel:obj:200501" version="1">
>                          <ind-def:filepath>/etc/passwd</ind-def:filepath>
>                          <ind-def:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind-def:pattern>
>                          <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
>                  </ind-def:textfilecontent54_object>
>
> And this is used in another test:
>                  <unix-def:file_state id="oval:gov.nist.usgcb.rhel:ste:20050" version="1" comment="Files with a valid user id assigned">
>                          <unix-def:user_id datatype="int" var_check="at least one" var_ref="oval:gov.nist.usgcb.rhel:var:200501"/>
>                  </unix-def:file_state>
>
>
> which checks the results of recursing the local file system:
>
>                  <unix-def:file_object id="oval:gov.nist.usgcb.rhel:obj:20050" version="1" comment="all local files without a valid user assigned">
>                          <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
>                          <unix-def:path>/</unix-def:path>
>                          <unix-def:filename operation="pattern match">.*</unix-def:filename>
>                          <filter>oval:gov.nist.usgcb.rhel:ste:20050</filter>
>                  </unix-def:file_object>
>
> This was working in the past.
>
> -Steve



More information about the scap-security-guide mailing list