[PATCH 3/3] OVAL + bash remediation - file_permissions_etc_shadow
Shawn Wells
shawn at redhat.com
Sat Oct 26 04:45:21 UTC 2013
-------------- next part --------------
>From fbf84704a4d14f9d2e2df344212462255d7ddff7 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 26 Oct 2013 00:41:23 -0400
Subject: [PATCH 3/3] OVAL + bash remediation - file_permissions_etc_shadow
- Updated XCCDF/OVAL namings, perms_shadow_file => file_permissions_etc_shadow
- Added bash remediation script
---
RHEL6/input/checks/file_permissions_etc_shadow.xml | 3 +--
.../fixes/bash/file_permissions_etc_shadow.sh | 1 +
RHEL6/input/profiles/CS2.xml | 2 +-
RHEL6/input/profiles/common.xml | 2 +-
RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +-
RHEL6/input/profiles/nist-CL-IL-AL.xml | 2 +-
RHEL6/input/profiles/rht-ccp.xml | 2 +-
RHEL6/input/profiles/usgcb-rhel6-server.xml | 2 +-
RHEL6/input/system/permissions/files.xml | 2 +-
9 files changed, 9 insertions(+), 9 deletions(-)
create mode 100644 RHEL6/input/fixes/bash/file_permissions_etc_shadow.sh
diff --git a/RHEL6/input/checks/file_permissions_etc_shadow.xml b/RHEL6/input/checks/file_permissions_etc_shadow.xml
index 5256c37..136ab7a 100644
--- a/RHEL6/input/checks/file_permissions_etc_shadow.xml
+++ b/RHEL6/input/checks/file_permissions_etc_shadow.xml
@@ -21,8 +21,7 @@
<unix:state state_ref="_etc_shadow_state_mode_0000" />
</unix:file_test>
<unix:file_object comment="/etc/shadow" id="object_etc_shadow" version="1">
- <unix:path>/etc</unix:path>
- <unix:filename>shadow</unix:filename>
+ <unix:filepath>/etc/shadow</unix:filepath>
</unix:file_object>
<unix:file_state id="_etc_shadow_state_uid_0" version="1">
<unix:user_id datatype="int" operation="equals">0</unix:user_id>
diff --git a/RHEL6/input/fixes/bash/file_permissions_etc_shadow.sh b/RHEL6/input/fixes/bash/file_permissions_etc_shadow.sh
new file mode 100644
index 0000000..2c69129
--- /dev/null
+++ b/RHEL6/input/fixes/bash/file_permissions_etc_shadow.sh
@@ -0,0 +1 @@
+chmod 0000 /etc/shadow
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index ada9760..35b88b5 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -150,7 +150,7 @@
<select idref="userowner_shadow_file" selected="true"/>
<select idref="groupowner_shadow_file" selected="true"/>
-<select idref="perms_shadow_file" selected="true"/>
+<select idref="file_permissions_etc_shadow" selected="true"/>
<select idref="userowner_gshadow_file" selected="true"/>
<select idref="groupowner_gshadow_file" selected="true"/>
<select idref="perms_gshadow_file" selected="true"/>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index bac6296..4ef3c0d 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -26,7 +26,7 @@
<select idref="userowner_shadow_file" selected="true"/>
<select idref="groupowner_shadow_file" selected="true"/>
-<select idref="perms_shadow_file" selected="true"/>
+<select idref="file_permissions_etc_shadow" selected="true"/>
<select idref="userowner_gshadow_file" selected="true"/>
<select idref="groupowner_gshadow_file" selected="true"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index a5f7e13..2d5ae03 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -41,7 +41,7 @@
<select idref="umask_for_daemons" selected="true" />
<select idref="userowner_shadow_file" selected="true" />
<select idref="groupowner_shadow_file" selected="true" />
-<select idref="perms_shadow_file" selected="true"/>
+<select idref="file_permissions_etc_shadow" selected="true"/>
<select idref="userowner_group_file" selected="true" />
<select idref="groupowner_group_file" selected="true" />
<select idref="perms_group_file" selected="true" />
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 2e7a17f..f633f5e 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -135,7 +135,7 @@ assurance."</description>
<select idref="audit_logs_rootowner" selected="true" \>
<select idref="userowner_shadow_file" selected="true" \>
<select idref="groupowner_shadow_file" selected="true" \>
-<select idref="perms_shadow_file" selected="true" \>
+<select idref="file_permissions_etc_shadow" selected="true" \>
<select idref="userowner_group_file" selected="true" \>
<select idref="groupowner_group_file" selected="true" \>
<select idref="perms_group_file" selected="true" \>
diff --git a/RHEL6/input/profiles/rht-ccp.xml b/RHEL6/input/profiles/rht-ccp.xml
index daf6e9c..173a891 100644
--- a/RHEL6/input/profiles/rht-ccp.xml
+++ b/RHEL6/input/profiles/rht-ccp.xml
@@ -69,7 +69,7 @@
<!-- FILE PERMISSION CHECKS -->
<select idref="userowner_shadow_file" selected="true"/>
<select idref="groupowner_shadow_file" selected="true"/>
-<select idref="perms_shadow_file" selected="true"/>
+<select idref="file_permissions_etc_shadow" selected="true"/>
<select idref="userowner_gshadow_file" selected="true"/>
<select idref="groupowner_gshadow_file" selected="true"/>
<select idref="perms_gshadow_file" selected="true"/>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 28ec60c..2c72684 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -36,7 +36,7 @@
<select idref="perms_gshadow_file" selected="true" /> <!-- RHEL5 had this as chmod 400, RHEL6 as 0000 -->
<select idref="userowner_gshadow_file" selected="true" />
<select idref="groupowner_gshadow_file" selected="true" />
-<select idref="perms_shadow_file" selected="true" /> <!-- RHEL5 as 400, RHEL6 as 000 -->
+<select idref="file_permissions_etc_shadow" selected="true" /> <!-- RHEL5 as 400, RHEL6 as 000 -->
<select idref="userowner_shadow_file" selected="true" />
<select idref="groupowner_shadow_file" selected="true" />
<select idref="perms_group_file" selected="true" />
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index 55e2c17..a35bf0b 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -44,7 +44,7 @@ critical for system security.</rationale>
<tested by="DS" on="20121026"/>
</Rule>
-<Rule id="perms_shadow_file" severity="medium">
+<Rule id="file_permissions_etc_shadow" severity="medium">
<title>Verify Permissions on <tt>shadow</tt> File</title>
<description><fileperms-desc-macro file="/etc/shadow" perms="0000"/></description>
<ocil><fileperms-check-macro file="/etc/shadow" perms="----------"/></ocil>
--
1.7.1
More information about the scap-security-guide
mailing list