[PATCH] Added OVAL content for the file_ownership_binary_dirs rule as the file file_ownership_binary_dirs.xml and added the oval id to the corresponding XCCDF content in files.xml

Caleb Cooper coopercd at ornl.gov
Tue Oct 1 14:06:39 UTC 2013


Signed-off-by: Caleb Cooper <coopercd at ornl.gov>
---
 RHEL6/input/checks/file_ownership_binary_dirs.xml |  163 +++++++++++++++++++++
 1 files changed, 163 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/checks/file_ownership_binary_dirs.xml

diff --git a/RHEL6/input/checks/file_ownership_binary_dirs.xml b/RHEL6/input/checks/file_ownership_binary_dirs.xml
new file mode 100644
index 0000000..b787191
--- /dev/null
+++ b/RHEL6/input/checks/file_ownership_binary_dirs.xml
@@ -0,0 +1,163 @@
+<def-group>
+  <definition class="compliance" id="file_ownership_binary_dirs" version="1">
+    <metadata>
+      <title>Verify that System Executables Have Root Ownership</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and objects therein, are owned by root</description>
+      <reference source="swells" ref_id="20130914" ref_url="test_attestation" />
+    </metadata>
+    <criteria operator="AND">
+      <criterion test_ref="test_ownership_bin_dir" />
+      <criterion test_ref="test_ownership_sbin_dir" />
+      <criterion test_ref="test_ownership_usr_bin_dir" />
+      <criterion test_ref="test_ownership_usr_sbin_dir" />
+      <criterion test_ref="test_ownership_usr_local_bin_dir" />
+      <criterion test_ref="test_ownership_usr_local_bin_dir" />
+      <criterion test_ref="test_ownership_bin_files" />
+      <criterion test_ref="test_ownership_sbin_files" />
+      <criterion test_ref="test_ownership_usr_bin_files" />
+      <criterion test_ref="test_ownership_usr_sbin_files" />
+      <criterion test_ref="test_ownership_usr_local_sbin_files" />
+      <criterion test_ref="test_ownership_usr_local_sbin_files" />
+    </criteria>
+  </definition>
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/bin directories uid root" id="test_ownership_bin_dir" version="1">
+    <unix:object object_ref="file_ownership_object_bin_dir" />
+  </unix:file_test>
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/bin files uid root" id="test_ownership_bin_files" version="1">
+    <unix:object object_ref="object_file_ownership_bin_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/lib directories" id="file_ownership_object_bin_dir" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/bin</unix:path>
+    <unix:filename xsi:nil="true" />
+    <filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/bin files" id="object_file_ownership_bin_files" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/bin</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+   <filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/sbin directories uid root" id="test_ownership_sbin_dir" version="1">
+    <unix:object object_ref="object_file_ownership_sbin_dir" />
+  </unix:file_test>
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/sbin files uid root" id="test_ownership_sbin_files" version="1">
+    <unix:object object_ref="object_file_ownership_sbin_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/sbin directories" id="object_file_ownership_sbin_dir" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/sbin</unix:path>
+    <unix:filename xsi:nil="true" />
+    <filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/sbin files" id="object_file_ownership_sbin_files" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/sbin</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/bin directories uid root" id="test_ownership_usr_bin_dir" version="1">
+    <unix:object object_ref="object_file_ownership_usr_bin_dir" />
+  </unix:file_test>
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/bin files uid root" id="test_ownership_usr_bin_files" version="1">
+    <unix:object object_ref="object_file_ownership_usr_bin_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/usr/bin directories" id="object_file_ownership_usr_bin_dir" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/bin</unix:path>
+    <unix:filename xsi:nil="true" />
+	<filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/usr/bin files" id="object_file_ownership_usr_bin_files" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/bin</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">state_owner_not_root</filter>
+  </unix:file_object>  
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/sbin directories uid root" id="test_ownership_usr_sbin_dir" version="1">
+    <unix:object object_ref="object_file_ownership_usr_sbin_dir" />
+  </unix:file_test>
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/sbin files uid root" id="test_ownership_usr_sbin_files" version="1">
+    <unix:object object_ref="object_file_ownership_usr_sbin_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/usr/sbin directories" id="object_file_ownership_usr_sbin_dir" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/sbin</unix:path>
+    <unix:filename xsi:nil="true" />
+	<filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/usr/sbin files" id="object_file_ownership_usr_sbin_files" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/sbin</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/local/bin directories uid root" id="test_ownership_usr_local_bin_dir" version="1">
+    <unix:object object_ref="object_file_ownership_usr_local_bin_dir" />
+  </unix:file_test>
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/local/bin files uid root" id="test_ownership_usr_local_bin_files" version="1">
+    <unix:object object_ref="object_file_ownership_usr_local_bin_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/usr/local/bin directories" id="object_file_ownership_usr_local_bin_dir" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/local/bin</unix:path>
+    <unix:filename xsi:nil="true" />
+   <filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/usr/local/bin files" id="object_file_ownership_usr_local_bin_files" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/local/bin</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+  
+  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/local/sbin directories uid root" id="test_ownership_usr_local_sbin_dir" version="1">
+    <unix:object object_ref="object_file_ownership_usr_local_sbin_dir" />
+  </unix:file_test>
+
+  <unix:file_test  check="all" check_existence="none_exist" comment="/usr/local/sbin files uid root" id="test_ownership_usr_local_sbin_files" version="1">
+    <unix:object object_ref="object_file_ownership_usr_local_sbin_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/usr/local/sbin directories" id="object_file_ownership_usr_local_sbin_dir" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/local/sbin</unix:path>
+    <unix:filename xsi:nil="true" />
+   <filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/usr/local/sbin files" id="object_file_ownership_usr_local_sbin_files" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/local/sbin</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">state_owner_not_root</filter>
+  </unix:file_object>
+
+  <unix:file_state id="state_owner_not_root" version="1" operator="OR">
+<!--    <unix:group_id datatype="int" operation="not equal">0</unix:group_id> -->
+    <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
+  </unix:file_state>
+</def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list