Suggestion on the 'Ensure All Files Are Owned...' items

Maura Dailey maura at eclipse.ncsc.mil
Tue Jul 23 21:12:04 UTC 2013


The current check that's checked into git is broken. The 
permissions_ungroupowned.xml check is searching the local file system 
for things with group_id set to 0 and negating the result of the check. 
That's all it's doing. The permissions_unowned.xml check was doing the 
same thing, but with user_ids set to 0. I feel like it was guaranteed to 
fail.

On 07/23/2013 04:31 PM, Andrew Gilmore wrote:
>
> I, along with Robert, assumed that the test was using some sort of 
> find(1) invocation. It appears not to be, although this OVAL is pretty 
> opaque to me.
>
> When I see the current check failing against my system, I then run a 
> find command, and the only output is complaints about /proc entries. I 
> then assumed that this output was why the check was failing.
>
> I can confirm that this check does fail against my system, or at least 
> that testcheck returns false. The results file points at /.autofsck 
> and /.readahead_collect, which doesn't make sense at all.
>
> This is one of the more frustrating false positives that I have.
>
> Andrew
>
>
>
> On Tue, Jul 23, 2013 at 1:47 PM, Maura Dailey <maura at eclipse.ncsc.mil 
> <mailto:maura at eclipse.ncsc.mil>> wrote:
>
>     Just an aside, I did some poking around, and it is possible to
>     eliminate directories from the search. I looked at the USGCB
>     stuffs and here's what I put together for
>     file_permissions_unowned.xml in OVAL to eliminate /proc. I can do
>     the same for the group id version. To add more exclusions, add an
>     '|' after proc, and type in another directory path. It doesn't
>     seem to care if you escape the forward slashes, but I left that in
>     just in case the behavior changes later.
>
>     If anyone does figure out how to query PAM or nslcd/nscd for
>     network user ids, I think you can add it as an extra filter option
>     to the file_permissions_unowned_object.
>
>     Please note, I have not gotten a single failure with this check
>     against /proc. I get thousands of failures on my workstation,
>     since I have large git repositories checked out to directories
>     owned by my network account on the root hard drive.
>
>     |<def-group>||
>     ||  <definition class="compliance" id="file_permissions_unowned"
>     version="1">||
>     ||    <metadata>||
>     ||      <title>Find files unowned by a user</title>||
>     ||      <affected family="unix">||
>     ||        <platform>Red Hat Enterprise Linux 6</platform>||
>     ||      </affected>||
>     ||      <description>All files should be owned by a
>     user</description>||
>     ||    </metadata>||
>     ||    <criteria>||
>     ||      <criterion comment="Check all files and make sure they are
>     owned by a user" test_ref="file_permissions_unowned_test" />||
>     ||    </criteria>||
>     ||  </definition>||
>     ||
>     ||  <unix:file_state
>     id="file_permissions_unowned_userid_list_match" version="1">||
>     ||    <unix:user_id var_check="at least one"
>     var_ref="file_permissions_unowned_userid_list" datatype="int" />||
>     ||  </unix:file_state>||
>     ||
>     ||  <local_variable id="file_permissions_unowned_userid_list"
>     comment="List of valid user ids" datatype="int" version="1">||
>     ||    <object_component item_field="subexpression"
>     object_ref="file_permissions_unowned_userid_list_object" />||
>     ||  </local_variable>||
>     ||
>     ||  <ind:textfilecontent54_object
>     id="file_permissions_unowned_userid_list_object" version="1">||
>     ||<ind:filepath>/etc/passwd</ind:filepath>||
>     ||    <ind:pattern operation="pattern
>     match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern>||
>     ||    <ind:instance operation="greater than or equal"
>     datatype="int">1</ind:instance>||
>     ||  </ind:textfilecontent54_object>||
>     ||
>     ||  <unix:file_object comment="all local files"
>     id="file_permissions_unowned_object" version="1">||
>     ||    <unix:behaviors recurse="symlinks and directories"
>     recurse_direction="down" recurse_file_system="local" />||
>     ||    <unix:filepath operation="pattern
>     match">^(?!\/proc)/</unix:filepath>||
>     ||    <filter
>     action="exclude">file_permissions_unowned_userid_list_match</filter>||
>     ||  </unix:file_object>||
>     ||
>     ||  <unix:file_test check="all" check_existence="none_exist"
>     comment="Check user ids on all files on the system"
>     id="file_permissions_unowned_test" version="1">||
>     ||    <unix:object object_ref="file_permissions_unowned_object" />||
>     ||  </unix:file_test>||
>     ||</def-group>|
>
>     - Maura Dailey
>
>     _______________________________________________
>     scap-security-guide mailing list
>     scap-security-guide at lists.fedorahosted.org
>     <mailto:scap-security-guide at lists.fedorahosted.org>
>     https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130723/9bdbc45b/attachment.html>


More information about the scap-security-guide mailing list