[PATCH 08/11] OVAL update + remediation for accounts_umask_etc_profile

Shawn Wells shawn at redhat.com
Tue Nov 12 16:33:03 UTC 2013


-------------- next part --------------
>From ad39dd001cbc87106c43d96facaab12ec967f523 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 10 Nov 2013 02:31:45 -0500
Subject: [PATCH 08/11] OVAL update + remediation for accounts_umask_etc_profile
 - OVAL filename->filepath
 - Naming scheme update to accounts_* for consistency
 - Added remediation script

[root at SSG-RHEL6 checks]# var_accounts_user_umask=077 ; export var_accounts_user_umask
[root at SSG-RHEL6 checks]# ./testcheck.py accounts_umask_etc_profile.xml
external_variable with id : var_accounts_user_umask
Evaluating with OVAL tempfile : /tmp/accounts_umask_etc_profilevp6vwU.xml
Writing results to : /tmp/accounts_umask_etc_profilevp6vwU.xml-results
Definition oval:scap-security-guide.testing:def:289: false
Evaluation done.
[root at SSG-RHEL6 checks]# cd ../fixes/bash/
[root at SSG-RHEL6 bash]# bash accounts_umask_etc_profile.sh
[root at SSG-RHEL6 bash]# cd -
/var/www/html/scap-security-guide/RHEL6/input/checks
[root at SSG-RHEL6 checks]# ./testcheck.py accounts_umask_etc_profile.xml
external_variable with id : var_accounts_user_umask
Evaluating with OVAL tempfile : /tmp/accounts_umask_etc_profileTUvqsj.xml
Writing results to : /tmp/accounts_umask_etc_profileTUvqsj.xml-results
Definition oval:scap-security-guide.testing:def:289: true
Evaluation done.
---
 RHEL6/input/checks/accounts_umask_cshrc.xml        |    3 +--
 RHEL6/input/checks/accounts_umask_etc_profile.xml  |    3 +--
 .../input/fixes/bash/accounts_umask_etc_profile.sh |    8 ++++++++
 RHEL6/input/profiles/CS2.xml                       |    2 +-
 RHEL6/input/profiles/stig-rhel6-server.xml         |    2 +-
 RHEL6/input/profiles/test.xml                      |    2 +-
 RHEL6/input/profiles/usgcb-rhel6-server.xml        |    2 +-
 RHEL6/input/system/accounts/session.xml            |    2 +-
 8 files changed, 15 insertions(+), 9 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/accounts_umask_etc_profile.sh

diff --git a/RHEL6/input/checks/accounts_umask_cshrc.xml b/RHEL6/input/checks/accounts_umask_cshrc.xml
index 86921e1..3919453 100644
--- a/RHEL6/input/checks/accounts_umask_cshrc.xml
+++ b/RHEL6/input/checks/accounts_umask_cshrc.xml
@@ -24,8 +24,7 @@
   </ind:textfilecontent54_state>
   <external_variable comment="umask for user shell" datatype="string" id="var_accounts_user_umask" version="1" />
   <ind:textfilecontent54_object id="obj_accounts_umask_cshrc" version="1">
-    <ind:path>/etc</ind:path>
-    <ind:filename>csh.cshrc</ind:filename>
+    <ind:filepath>/etc/csh.cshrc</ind:filepath>
     <ind:pattern operation="pattern match">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
diff --git a/RHEL6/input/checks/accounts_umask_etc_profile.xml b/RHEL6/input/checks/accounts_umask_etc_profile.xml
index c7e753e..18e1226 100644
--- a/RHEL6/input/checks/accounts_umask_etc_profile.xml
+++ b/RHEL6/input/checks/accounts_umask_etc_profile.xml
@@ -28,8 +28,7 @@
   <external_variable comment="user umask" datatype="string" id="var_accounts_user_umask" version="1" />
   <ind:textfilecontent54_object id="obj_accounts_umask_etc_profile"
   version="1">
-    <ind:path>/etc</ind:path>
-    <ind:filename>profile</ind:filename>
+    <ind:filepath>/etc/profile</ind:filepath>
     <ind:pattern operation="pattern match">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
diff --git a/RHEL6/input/fixes/bash/accounts_umask_etc_profile.sh b/RHEL6/input/fixes/bash/accounts_umask_etc_profile.sh
new file mode 100644
index 0000000..38e969a
--- /dev/null
+++ b/RHEL6/input/fixes/bash/accounts_umask_etc_profile.sh
@@ -0,0 +1,8 @@
+source ./templates/support.sh
+populate var_accounts_user_umask
+
+grep -q umask /etc/profile && \
+  sed -i "s/umask.*/umask $var_accounts_user_umask/g" /etc/profile
+if ! [ $? -eq 0 ]; then
+    echo "umask $var_accounts_user_umask" >> /etc/profile
+fi
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index 05966f0..171f701 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -91,7 +91,7 @@
 <select idref="root_path_default" selected="true" />
 <select idref="no_empty_passwords" selected="true"/>
 <select idref="accounts_umask_cshrc" selected="true" />
-<select idref="user_umask_profile" selected="true" />
+<select idref="accounts_umask_etc_profile" selected="true" />
 
 <select idref="no_netrc_files" selected="true" />
 <select idref="disable_interactive_boot" selected="true"/>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index 510e634..edf6ef4 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -66,7 +66,7 @@
 
 <select idref="accounts_umask_bashrc" selected="true" />
 <select idref="accounts_umask_cshrc" selected="true" />
-<select idref="user_umask_profile" selected="true" />
+<select idref="accounts_umask_etc_profile" selected="true" />
 <select idref="user_umask_logindefs" selected="true" />
 <refine-value idref="var_accounts_user_umask" selector="077" />
 
diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml
index 9f05e6e..d815897 100644
--- a/RHEL6/input/profiles/test.xml
+++ b/RHEL6/input/profiles/test.xml
@@ -45,7 +45,7 @@
 
 <select idref="accounts_umask_bashrc" selected="true" />
 <select idref="accounts_umask_cshrc" selected="true" />
-<select idref="user_umask_profile" selected="true" />
+<select idref="accounts_umask_etc_profile" selected="true" />
 <select idref="user_umask_logindefs" selected="true" />
 <refine-value idref="var_accounts_user_umask" selector="077" />
 
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 70062be..aa20ed6 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -94,7 +94,7 @@
 <refine-value idref="umask_user_value" selector="077" />
 <select idref="accounts_umask_bashrc" selected="true" />
 <select idref="accounts_umask_cshrc" selected="true" />
-<select idref="user_umask_profile" selected="true" />
+<select idref="accounts_umask_etc_profile" selected="true" />
 <select idref="user_umask_logindefs" selected="true" />
 <select idref="user_owner_grub_conf" selected="true" />
 <select idref="group_owner_grub_conf" selected="true" />
diff --git a/RHEL6/input/system/accounts/session.xml b/RHEL6/input/system/accounts/session.xml
index 069d8b1..3d2574f 100644
--- a/RHEL6/input/system/accounts/session.xml
+++ b/RHEL6/input/system/accounts/session.xml
@@ -255,7 +255,7 @@ umask 077</pre>
 <tested by="swells" on="20120929"/>
 </Rule>
 
-<Rule id="user_umask_profile">
+<Rule id="accounts_umask_etc_profile">
 <title>Ensure the Default Umask is Set Correctly in /etc/profile</title>
 <description>
 To ensure the default umask controlled by <tt>/etc/profile</tt> is set properly,
-- 
1.7.1



More information about the scap-security-guide mailing list