[PATCH] Update from deprecated rpmverify_* to rpmverifyfile_* checks

Maura Dailey maura at eclipse.ncsc.mil
Tue Jun 4 16:27:37 UTC 2013


On 06/03/2013 09:48 PM, Shawn Wells wrote:
> On 6/3/13 6:21 PM, Maura Dailey wrote:
>> Little patch to eliminate a deprecated family of checks and tests. I 
>> compared the results of testcheck.py against the
>> current list of complaints that rpm -qVa outputs on our systems and 
>> everything seems to match up.
> This matches the specs @ 
> http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/linux-definitions-schema.html#RpmVerifyFileBehaviors, 
> and resolves the make validate errors.
>
> Ack, and thank you!
>
>
>> I still can't get accounts_root_path_dirs_no_write.xml to work 
>> correctly (specifying a file or directory directly in
>> place of parsing out PATH works, but trying to get it to use 
>> variables correctly is stumping me).
>
>
> Can you toss up a patch of what you've wrangled so far?
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

Sure, I've attached the patch to this email. There is a commented out 
line that points to a bin directory in my home directory. If you 
uncomment that, and comment out the line after it that refers to the 
variable, these checks work exactly as expected. With variables, 
however, it returns with the flag "does not exist". (It was an older 
check, so one of the things I was doing was creating new names for all 
the tests and checks, hence why so many lines were changed.)

- Maura Dailey
-------------- next part --------------
From 22903cc47f2f6f04d1a920e9278aec44ef02365b Mon Sep 17 00:00:00 2001
From: Maura Dailey <maura at eclipse.ncsc.mil>
Date: Tue, 4 Jun 2013 12:22:14 -0400
Subject: [PATCH] So far...


Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
---
 .../checks/accounts_root_path_dirs_no_write.xml    |   67 +++++++------------
 1 files changed, 25 insertions(+), 42 deletions(-)

diff --git a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
index 36a02cf..aed1e8c 100644
--- a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
+++ b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
@@ -1,60 +1,43 @@
 <def-group>
-  <definition class="compliance"
-  id="accounts_root_path_dirs_no_write" version="1">
+  <definition class="compliance" id="accounts_root_path_dirs_no_write" version="1">
     <metadata>
-      <title>Write permissions are disabled for group and other in
-      all directories in Root's Path</title>
+      <title>Write permissions are disabled for group and other in all directories in Root's Path</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>Check each directory in root's path and make use
-      it does not grant write permission to group and
-      other</description>
+      <description>Check each directory in root's path and make use it does not grant write permission to group and other</description>
     </metadata>
-    <criteria comment="Check that write permission to group and other in root's path is denied"
-    negate="true" operator="OR">
-      <criterion comment="Check for write permission to group in root's path"
-      test_ref="test_2008551" />
-      <criterion comment="Check for write permission to other in root's path"
-      test_ref="test_2008552" />
+    <criteria comment="Check that write permission to group and other in root's path is denied" operator="AND">
+      <criterion comment="Check for write permission to group in root's path" test_ref="test_accounts_root_path_dirs_nogroupwrite" />
+      <criterion comment="Check for write permission to other in root's path" test_ref="test_accounts_root_path_dirs_nootherwrite" />
     </criteria>
   </definition>
-  <unix:file_test check="all" check_existence="any_exist"
-  comment="Check that write permission to group and other in root's path is denied"
-  id="test_2008551" version="1">
-    <unix:object object_ref="obj_200855" />
-    <unix:state state_ref="state_2008551" />
+  <unix:file_test check="none satisfy" comment="Check that write permission to group in root's path is denied" id="test_accounts_root_path_dirs_nogroupwrite" version="1">
+    <unix:object object_ref="object_accounts_root_path_dirs_no_write" />
+    <unix:state state_ref="state_accounts_root_path_dirs_groupwrite" />
   </unix:file_test>
-  <unix:file_state comment="Group has write privilege"
-  id="state_2008551" version="1">
+  <unix:file_state comment="Group has write privilege" id="state_accounts_root_path_dirs_groupwrite" version="1">
     <unix:gwrite datatype="boolean">1</unix:gwrite>
   </unix:file_state>
-  <unix:file_object xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  comment="root's PATH" id="obj_200855"
-  version="1">
-    <unix:path var_ref="var_200855" />
+  <unix:file_test check="none satisfy" comment="Check that write permission to other in root's path is denied" id="test_accounts_root_path_dirs_nootherwrite" version="1">
+    <unix:object object_ref="object_accounts_root_path_dirs_no_write" />
+    <unix:state state_ref="state_accounts_root_path_dirs_otherwrite" />
+  </unix:file_test>
+  <unix:file_state comment="Other has write privilege" id="state_accounts_root_path_dirs_otherwrite" version="1">
+    <unix:owrite datatype="boolean">1</unix:owrite>
+  </unix:file_state>
+  <unix:file_object comment="root's PATH" id="object_accounts_root_path_dirs_no_write" version="1">
+    <!--<unix:path>/home/maura/bin</unix:path>-->
+    <unix:path var_ref="var_accounts_root_path_dirs_no_write" />
     <unix:filename xsi:nil="true" />
   </unix:file_object>
-  <local_variable comment="Split the PATH on the : delimiter"
-  datatype="string" id="var_200855"
-  version="1">
+  <local_variable comment="Split the PATH on the : delimiter" datatype="string" id="var_accounts_root_path_dirs_no_write" version="1">
     <split delimiter=":">
-      <object_component item_field="value"
-      object_ref="obj_20085" />
+      <object_component item_field="value" object_ref="object_env_var_path" />
     </split>
   </local_variable>
-  <ind:environmentvariable_object id="obj_20085"
-  version="1">
+  <ind:environmentvariable58_object id="object_env_var_path" version="1">
+    <ind:pid xsi:nil="true" datatype="int" />
     <ind:name>PATH</ind:name>
-  </ind:environmentvariable_object>
-  <unix:file_test check="all" check_existence="any_exist"
-  comment="Check that write permission to group and other in root's path is denied"
-  id="test_2008552" version="1">
-    <unix:object object_ref="obj_200855" />
-    <unix:state state_ref="state_2008552" />
-  </unix:file_test>
-  <unix:file_state comment="Other has write privilege"
-  id="state_2008552" version="1">
-    <unix:owrite datatype="boolean">1</unix:owrite>
-  </unix:file_state>
+  </ind:environmentvariable58_object>
 </def-group>
-- 
1.7.1


More information about the scap-security-guide mailing list