[PATCH 1/3] OVAL signoff for template_permissions

Shawn Wells shawn.d.wells at gmail.com
Sun Sep 1 14:16:18 UTC 2013


-------------- next part --------------
>From 297ffb26df9e4bcce2ee9d74083fb979f4d654a8 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 30 Aug 2013 16:46:24 -0400
Subject: [PATCH 1/3] OVAL signoff for template_permissions

[root at rhel6 checks]# chown shawn /etc/gshadow ; ./testcheck.py file_permissions_etc_gshadow.xml ; chown root /etc/gshadow ; \
> chgrp shawn /etc/gshadow ; ./testcheck.py file_permissions_etc_gshadow.xml ; chgrp root /etc/gshadow ; \
> chmod 777 /etc/gshadow ; ./testcheck.py file_permissions_etc_gshadow.xml ; chmod 000 /etc/gshadow ; \
> ./testcheck.py file_permissions_etc_gshadow.xml
Evaluating with OVAL tempfile : /tmp/file_permissions_etc_gshadowrY6zAE.xml
Writing results to : /tmp/file_permissions_etc_gshadowrY6zAE.xml-results
Definition oval:scap-security-guide.testing:def:100: false
Evaluation done.
Evaluating with OVAL tempfile : /tmp/file_permissions_etc_gshadowf6I37s.xml
Writing results to : /tmp/file_permissions_etc_gshadowf6I37s.xml-results
Definition oval:scap-security-guide.testing:def:100: false
Evaluation done.
Evaluating with OVAL tempfile : /tmp/file_permissions_etc_gshadowO2S96R.xml
Writing results to : /tmp/file_permissions_etc_gshadowO2S96R.xml-results
Definition oval:scap-security-guide.testing:def:100: false
Evaluation done.
Evaluating with OVAL tempfile : /tmp/file_permissions_etc_gshadowbPLxwO.xml
Writing results to : /tmp/file_permissions_etc_gshadowbPLxwO.xml-results
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.
---
 .../file_permissions_boot_grub_grub_conf.xml       |   47 ++++++++++++++++++++
 .../input/checks/file_permissions_etc_gshadow.xml  |    1 +
 RHEL6/input/checks/file_permissions_etc_passwd.xml |    1 +
 RHEL6/input/checks/file_permissions_etc_shadow.xml |    1 +
 RHEL6/input/checks/templates/template_permissions  |    1 +
 5 files changed, 51 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/checks/file_permissions_boot_grub_grub_conf.xml

diff --git a/RHEL6/input/checks/file_permissions_boot_grub_grub_conf.xml b/RHEL6/input/checks/file_permissions_boot_grub_grub_conf.xml
new file mode 100644
index 0000000..da0afec
--- /dev/null
+++ b/RHEL6/input/checks/file_permissions_boot_grub_grub_conf.xml
@@ -0,0 +1,47 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_permission_checks.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="file_permissions_boot_grub_grub_conf" version="1">
+    <metadata>
+      <title>Verify /boot/grub/grub.conf Permissions</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>This test makes sure that /boot/grub/grub.conf is owned by 0, group owned by 0, and has mode 0600. If
+      the target file or directory has an extended ACL then it will fail the mode check.</description>
+      <reference source="swells" ref_id="20130831" ref_url="test_attestation"/>
+    </metadata>
+    <criteria>
+      <criterion test_ref="test_boot_grub_grub_conf" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="all_exist" comment="/boot/grub/grub.conf mode and ownership" id="test_boot_grub_grub_conf" version="1">
+    <unix:object object_ref="object_boot_grub_grub_conf" />
+    <unix:state state_ref="_boot_grub_grub_conf_state_uid_0" />
+    <unix:state state_ref="_boot_grub_grub_conf_state_gid_0" />
+    <unix:state state_ref="_boot_grub_grub_conf_state_mode_0600" />
+  </unix:file_test>
+  <unix:file_object comment="/boot/grub/grub.conf" id="object_boot_grub_grub_conf" version="1">
+    <unix:path>/boot/grub</unix:path>
+    <unix:filename>grub.conf</unix:filename>
+  </unix:file_object>
+  <unix:file_state id="_boot_grub_grub_conf_state_uid_0" version="1">
+    <unix:user_id datatype="int" operation="equals">0</unix:user_id>
+  </unix:file_state>
+  <unix:file_state id="_boot_grub_grub_conf_state_gid_0" version="1">
+    <unix:group_id datatype="int" operation="equals">0</unix:group_id>
+  </unix:file_state>
+  <unix:file_state id="_boot_grub_grub_conf_state_mode_0600" version="1">
+	<unix:suid datatype="boolean">false</unix:suid>
+	<unix:sgid datatype="boolean">false</unix:sgid>
+	<unix:sticky datatype="boolean">false</unix:sticky>
+	<unix:uread datatype="boolean">true</unix:uread>
+	<unix:uwrite datatype="boolean">true</unix:uwrite>
+	<unix:uexec datatype="boolean">false</unix:uexec>
+	<unix:gread datatype="boolean">false</unix:gread>
+	<unix:gwrite datatype="boolean">false</unix:gwrite>
+	<unix:gexec datatype="boolean">false</unix:gexec>
+	<unix:oread datatype="boolean">false</unix:oread>
+	<unix:owrite datatype="boolean">false</unix:owrite>
+	<unix:oexec datatype="boolean">false</unix:oexec>
+  </unix:file_state>
+</def-group>
diff --git a/RHEL6/input/checks/file_permissions_etc_gshadow.xml b/RHEL6/input/checks/file_permissions_etc_gshadow.xml
index ea3540c..1a30780 100644
--- a/RHEL6/input/checks/file_permissions_etc_gshadow.xml
+++ b/RHEL6/input/checks/file_permissions_etc_gshadow.xml
@@ -8,6 +8,7 @@
       </affected>
       <description>This test makes sure that /etc/gshadow is owned by 0, group owned by 0, and has mode 0000. If
       the target file or directory has an extended ACL then it will fail the mode check.</description>
+      <reference source="swells" ref_id="20130831" ref_url="test_attestation"/>
     </metadata>
     <criteria>
       <criterion test_ref="test_etc_gshadow" />
diff --git a/RHEL6/input/checks/file_permissions_etc_passwd.xml b/RHEL6/input/checks/file_permissions_etc_passwd.xml
index 042f088..624baa9 100644
--- a/RHEL6/input/checks/file_permissions_etc_passwd.xml
+++ b/RHEL6/input/checks/file_permissions_etc_passwd.xml
@@ -8,6 +8,7 @@
       </affected>
       <description>This test makes sure that /etc/passwd is owned by 0, group owned by 0, and has mode 0644. If
       the target file or directory has an extended ACL then it will fail the mode check.</description>
+      <reference source="swells" ref_id="20130831" ref_url="test_attestation"/>
     </metadata>
     <criteria>
       <criterion test_ref="test_etc_passwd" />
diff --git a/RHEL6/input/checks/file_permissions_etc_shadow.xml b/RHEL6/input/checks/file_permissions_etc_shadow.xml
index 2e3a45c..5256c37 100644
--- a/RHEL6/input/checks/file_permissions_etc_shadow.xml
+++ b/RHEL6/input/checks/file_permissions_etc_shadow.xml
@@ -8,6 +8,7 @@
       </affected>
       <description>This test makes sure that /etc/shadow is owned by 0, group owned by 0, and has mode 0000. If
       the target file or directory has an extended ACL then it will fail the mode check.</description>
+      <reference source="swells" ref_id="20130831" ref_url="test_attestation"/>
     </metadata>
     <criteria>
       <criterion test_ref="test_etc_shadow" />
diff --git a/RHEL6/input/checks/templates/template_permissions b/RHEL6/input/checks/templates/template_permissions
index e0a2c62..9c92938 100644
--- a/RHEL6/input/checks/templates/template_permissions
+++ b/RHEL6/input/checks/templates/template_permissions
@@ -8,6 +8,7 @@
       </affected>
       <description>This test makes sure that FILEPATH is owned by FILEUID, group owned by FILEGID, and has mode FILEMODE. If
       the target file or directory has an extended ACL then it will fail the mode check.</description>
+      <reference source="swells" ref_id="20130831" ref_url="test_attestation"/>
     </metadata>
     <criteria>
       <criterion test_ref="testFILEID" />
-- 
1.7.1



More information about the scap-security-guide mailing list