[PATCH 06/11] Updated OVAL + remediation for accounts_umask_bashrc

Shawn Wells shawn at redhat.com
Tue Nov 12 16:32:52 UTC 2013


-------------- next part --------------
>From 5691cc2064ccc8fc170a3c986a27f175a2ed58d5 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 10 Nov 2013 01:51:47 -0500
Subject: [PATCH 06/11] Updated OVAL + remediation for accounts_umask_bashrc
 - filename/filepath update
 - Naming scheme update to accounts_* for consistency across checks
 - Added remediation

TESTING:
[root at SSG-RHEL6 checks]# var_accounts_user_umask=077; export var_accounts_user_umask
[root at SSG-RHEL6 checks]# ./testcheck.py accounts_umask_bashrc.xml
external_variable with id : var_accounts_user_umask
Evaluating with OVAL tempfile : /tmp/accounts_umask_bashrcWergkC.xml
Writing results to : /tmp/accounts_umask_bashrcWergkC.xml-results
Definition oval:scap-security-guide.testing:def:280: false
Evaluation done.
[root at SSG-RHEL6 checks]# cd ../fixes/bash/
[root at SSG-RHEL6 bash]# bash accounts_umask_bashrc.sh
[root at SSG-RHEL6 bash]# cd -
/var/www/html/scap-security-guide/RHEL6/input/checks
[root at SSG-RHEL6 checks]# ./testcheck.py accounts_umask_bashrc.xml
external_variable with id : var_accounts_user_umask
Evaluating with OVAL tempfile : /tmp/accounts_umask_bashrcpUWTIW.xml
Writing results to : /tmp/accounts_umask_bashrcpUWTIW.xml-results
Definition oval:scap-security-guide.testing:def:280: true
Evaluation done.
---
 RHEL6/input/checks/accounts_umask_bashrc.xml    |    3 +--
 RHEL6/input/fixes/bash/accounts_umask_bashrc.sh |    8 ++++++++
 RHEL6/input/profiles/CS2.xml                    |    2 +-
 RHEL6/input/profiles/stig-rhel6-server.xml      |    2 +-
 RHEL6/input/profiles/test.xml                   |    2 +-
 RHEL6/input/profiles/usgcb-rhel6-server.xml     |    2 +-
 RHEL6/input/system/accounts/session.xml         |    3 +--
 7 files changed, 14 insertions(+), 8 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/accounts_umask_bashrc.sh

diff --git a/RHEL6/input/checks/accounts_umask_bashrc.xml b/RHEL6/input/checks/accounts_umask_bashrc.xml
index 32c98d1..5c831fe 100644
--- a/RHEL6/input/checks/accounts_umask_bashrc.xml
+++ b/RHEL6/input/checks/accounts_umask_bashrc.xml
@@ -23,8 +23,7 @@
   </ind:textfilecontent54_state>
   <external_variable comment="umask for user shell" datatype="string" id="var_accounts_user_umask" version="1" />
   <ind:textfilecontent54_object id="obj_accounts_umask_bashrc" version="1">
-    <ind:path>/etc</ind:path>
-    <ind:filename>bashrc</ind:filename>
+    <ind:filepath>/etc/bashrc</ind:filepath>
     <ind:pattern operation="pattern match">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
diff --git a/RHEL6/input/fixes/bash/accounts_umask_bashrc.sh b/RHEL6/input/fixes/bash/accounts_umask_bashrc.sh
new file mode 100644
index 0000000..f949ac3
--- /dev/null
+++ b/RHEL6/input/fixes/bash/accounts_umask_bashrc.sh
@@ -0,0 +1,8 @@
+source ./templates/support.sh
+populate var_accounts_user_umask
+
+grep -q umask /etc/bashrc && \
+  sed -i "s/umask.*/umask $var_accounts_user_umask/g" /etc/bashrc
+if ! [ $? -eq 0 ]; then
+    echo "umask $var_accounts_user_umask" >> /etc/bashrc
+fi
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index b32b9d1..37608ea 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -84,7 +84,7 @@
 
 <select idref="root_paths" selected="true" />
 <select idref="root_path_no_groupother_writable" selected="true" />
-<select idref="user_umask_bashrc" selected="true" />
+<select idref="accounts_umask_bashrc" selected="true" />
 <select idref="user_umask_logindefs" selected="true" />
 <refine-value idref="var_accounts_user_umask" selector="077" />
 <select idref="no_shelllogin_for_systemaccounts" selected="true"/>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index 03c622b..f4be59b 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -64,7 +64,7 @@
 <select idref="snmpd_use_newer_protocol" selected="true" />
 <select idref="snmpd_not_default_password" selected="true" />
 
-<select idref="user_umask_bashrc" selected="true" />
+<select idref="accounts_umask_bashrc" selected="true" />
 <select idref="user_umask_cshrc" selected="true" />
 <select idref="user_umask_profile" selected="true" />
 <select idref="user_umask_logindefs" selected="true" />
diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml
index 564dbb5..f493bc4 100644
--- a/RHEL6/input/profiles/test.xml
+++ b/RHEL6/input/profiles/test.xml
@@ -43,7 +43,7 @@
 <refine-value idref="var_auditd_admin_space_left_action" selector="single"/>
 <refine-value idref="var_auditd_action_mail_acct" selector="root"/>
 
-<select idref="user_umask_bashrc" selected="true" />
+<select idref="accounts_umask_bashrc" selected="true" />
 <select idref="user_umask_cshrc" selected="true" />
 <select idref="user_umask_profile" selected="true" />
 <select idref="user_umask_logindefs" selected="true" />
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 8d68a5d..5deab0f 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -92,7 +92,7 @@
 <select idref="root_path_no_groupother_writable" selected="true" />
 <select idref="homedir_perms_no_groupwrite_worldread" selected="true" />
 <refine-value idref="umask_user_value" selector="077" />
-<select idref="user_umask_bashrc" selected="true" />
+<select idref="accounts_umask_bashrc" selected="true" />
 <select idref="user_umask_cshrc" selected="true" />
 <select idref="user_umask_profile" selected="true" />
 <select idref="user_umask_logindefs" selected="true" />
diff --git a/RHEL6/input/system/accounts/session.xml b/RHEL6/input/system/accounts/session.xml
index 1d71938..bf4af7c 100644
--- a/RHEL6/input/system/accounts/session.xml
+++ b/RHEL6/input/system/accounts/session.xml
@@ -205,7 +205,7 @@ operator="equals" interactive="0">
 <value selector="077">077</value>
 </Value>
 
-<Rule id="user_umask_bashrc">
+<Rule id="accounts_umask_bashrc">
 <title>Ensure the Default Bash Umask is Set Correctly</title>
 <description>
 To ensure the default umask for users of the Bash shell is set properly,
@@ -225,7 +225,6 @@ All output must show the value of <tt>umask</tt> set to 077, as shown below:
 umask 077
 umask 077</pre>
 </ocil>
-
 <ident cce="26917-5" />
 <oval id="accounts_umask_bashrc" value="var_accounts_user_umask"/>
 <ref nist="" disa="366"/>
-- 
1.7.1



More information about the scap-security-guide mailing list