[PATCH 3/3] OVAL + bash remediation - file_permissions_etc_shadow

Shawn Wells shawn at redhat.com
Sat Oct 26 04:45:21 UTC 2013


-------------- next part --------------
>From fbf84704a4d14f9d2e2df344212462255d7ddff7 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 26 Oct 2013 00:41:23 -0400
Subject: [PATCH 3/3] OVAL + bash remediation - file_permissions_etc_shadow
 - Updated XCCDF/OVAL namings, perms_shadow_file => file_permissions_etc_shadow
 - Added bash remediation script

---
 RHEL6/input/checks/file_permissions_etc_shadow.xml |    3 +--
 .../fixes/bash/file_permissions_etc_shadow.sh      |    1 +
 RHEL6/input/profiles/CS2.xml                       |    2 +-
 RHEL6/input/profiles/common.xml                    |    2 +-
 RHEL6/input/profiles/fisma-medium-rhel6-server.xml |    2 +-
 RHEL6/input/profiles/nist-CL-IL-AL.xml             |    2 +-
 RHEL6/input/profiles/rht-ccp.xml                   |    2 +-
 RHEL6/input/profiles/usgcb-rhel6-server.xml        |    2 +-
 RHEL6/input/system/permissions/files.xml           |    2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/file_permissions_etc_shadow.sh

diff --git a/RHEL6/input/checks/file_permissions_etc_shadow.xml b/RHEL6/input/checks/file_permissions_etc_shadow.xml
index 5256c37..136ab7a 100644
--- a/RHEL6/input/checks/file_permissions_etc_shadow.xml
+++ b/RHEL6/input/checks/file_permissions_etc_shadow.xml
@@ -21,8 +21,7 @@
     <unix:state state_ref="_etc_shadow_state_mode_0000" />
   </unix:file_test>
   <unix:file_object comment="/etc/shadow" id="object_etc_shadow" version="1">
-    <unix:path>/etc</unix:path>
-    <unix:filename>shadow</unix:filename>
+    <unix:filepath>/etc/shadow</unix:filepath>
   </unix:file_object>
   <unix:file_state id="_etc_shadow_state_uid_0" version="1">
     <unix:user_id datatype="int" operation="equals">0</unix:user_id>
diff --git a/RHEL6/input/fixes/bash/file_permissions_etc_shadow.sh b/RHEL6/input/fixes/bash/file_permissions_etc_shadow.sh
new file mode 100644
index 0000000..2c69129
--- /dev/null
+++ b/RHEL6/input/fixes/bash/file_permissions_etc_shadow.sh
@@ -0,0 +1 @@
+chmod 0000 /etc/shadow
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index ada9760..35b88b5 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -150,7 +150,7 @@
 
 <select idref="userowner_shadow_file" selected="true"/>
 <select idref="groupowner_shadow_file" selected="true"/>
-<select idref="perms_shadow_file" selected="true"/>
+<select idref="file_permissions_etc_shadow" selected="true"/>
 <select idref="userowner_gshadow_file" selected="true"/>
 <select idref="groupowner_gshadow_file" selected="true"/>
 <select idref="perms_gshadow_file" selected="true"/>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index bac6296..4ef3c0d 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -26,7 +26,7 @@
 
 <select idref="userowner_shadow_file" selected="true"/>
 <select idref="groupowner_shadow_file" selected="true"/>
-<select idref="perms_shadow_file" selected="true"/>
+<select idref="file_permissions_etc_shadow" selected="true"/>
 
 <select idref="userowner_gshadow_file" selected="true"/>
 <select idref="groupowner_gshadow_file" selected="true"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index a5f7e13..2d5ae03 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -41,7 +41,7 @@
 <select idref="umask_for_daemons" selected="true" />
 <select idref="userowner_shadow_file" selected="true" />
 <select idref="groupowner_shadow_file" selected="true" />
-<select idref="perms_shadow_file" selected="true"/>
+<select idref="file_permissions_etc_shadow" selected="true"/>
 <select idref="userowner_group_file" selected="true" />
 <select idref="groupowner_group_file" selected="true" />
 <select idref="perms_group_file" selected="true" />
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 2e7a17f..f633f5e 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -135,7 +135,7 @@ assurance."</description>
 <select idref="audit_logs_rootowner" selected="true" \>
 <select idref="userowner_shadow_file" selected="true" \>
 <select idref="groupowner_shadow_file" selected="true" \>
-<select idref="perms_shadow_file" selected="true" \>
+<select idref="file_permissions_etc_shadow" selected="true" \>
 <select idref="userowner_group_file" selected="true" \>
 <select idref="groupowner_group_file" selected="true" \>
 <select idref="perms_group_file" selected="true" \>
diff --git a/RHEL6/input/profiles/rht-ccp.xml b/RHEL6/input/profiles/rht-ccp.xml
index daf6e9c..173a891 100644
--- a/RHEL6/input/profiles/rht-ccp.xml
+++ b/RHEL6/input/profiles/rht-ccp.xml
@@ -69,7 +69,7 @@
 <!-- FILE PERMISSION CHECKS -->
 <select idref="userowner_shadow_file" selected="true"/>
 <select idref="groupowner_shadow_file" selected="true"/>
-<select idref="perms_shadow_file" selected="true"/>
+<select idref="file_permissions_etc_shadow" selected="true"/>
 <select idref="userowner_gshadow_file" selected="true"/>
 <select idref="groupowner_gshadow_file" selected="true"/>
 <select idref="perms_gshadow_file" selected="true"/>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 28ec60c..2c72684 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -36,7 +36,7 @@
 <select idref="perms_gshadow_file" selected="true" /> <!-- RHEL5 had this as chmod 400, RHEL6 as 0000 -->
 <select idref="userowner_gshadow_file" selected="true" />
 <select idref="groupowner_gshadow_file" selected="true" />
-<select idref="perms_shadow_file" selected="true" /> <!-- RHEL5 as 400, RHEL6 as 000 -->
+<select idref="file_permissions_etc_shadow" selected="true" /> <!-- RHEL5 as 400, RHEL6 as 000 -->
 <select idref="userowner_shadow_file" selected="true" />
 <select idref="groupowner_shadow_file" selected="true" />
 <select idref="perms_group_file" selected="true" /> 
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index 55e2c17..a35bf0b 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -44,7 +44,7 @@ critical for system security.</rationale>
 <tested by="DS" on="20121026"/>
 </Rule>
 
-<Rule id="perms_shadow_file" severity="medium">
+<Rule id="file_permissions_etc_shadow" severity="medium">
 <title>Verify Permissions on <tt>shadow</tt> File</title>
 <description><fileperms-desc-macro file="/etc/shadow" perms="0000"/></description>
 <ocil><fileperms-check-macro file="/etc/shadow" perms="----------"/></ocil>
-- 
1.7.1



More information about the scap-security-guide mailing list