[PATCH] grub.conf is not guaranteed to be in /boot/grub if the system is using EFI, so I added a test for its default location in /boot/efi/EFI/redhat

Maura Dailey maura at eclipse.ncsc.mil
Tue Sep 10 16:55:57 UTC 2013


No one's ACKED/NACKED these. Also, Shawn committed a patch that tries to 
template these checks, but templated checks won't work unless the system 
is guaranteed not to be using EFI or unless the template can handle two 
alternate file locations.

- Maura Dailey

On 08/30/2013 02:54 PM, Maura Dailey wrote:
> There isn't any way to do this the clever way, following the symlink /etc/grub.conf, so for now at least, I added a second path to check, the path for EFI in a default install.
>
> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
> ---
>   RHEL6/input/checks/file_group_owner_grub_conf.xml |   18 +++++++++++++++---
>   RHEL6/input/checks/file_user_owner_grub_conf.xml  |   18 +++++++++++++++---
>   2 files changed, 30 insertions(+), 6 deletions(-)
>
> diff --git a/RHEL6/input/checks/file_group_owner_grub_conf.xml b/RHEL6/input/checks/file_group_owner_grub_conf.xml
> index 3fc076a..4856fdf 100644
> --- a/RHEL6/input/checks/file_group_owner_grub_conf.xml
> +++ b/RHEL6/input/checks/file_group_owner_grub_conf.xml
> @@ -1,14 +1,16 @@
>   <def-group>
>     <definition class="compliance" id="file_group_owner_grub_conf" version="1">
>       <metadata>
> -      <title>File /boot/grub/grub.conf Owned By root Group </title>
> +      <title>File grub.conf Owned By root Group </title>
>         <affected family="unix">
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
> -      <description>The /boot/grub/grub.conf file should be owned by the root group.</description>
> +      <description>The grub.conf file should be owned by the root group.</description>
> +      <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
>       </metadata>
> -    <criteria>
> +    <criteria operator="OR">
>         <criterion test_ref="test_file_group_owner_grub_conf" />
> +      <criterion test_ref="test_file_group_owner_efi_grub_conf" />
>       </criteria>
>     </definition>
>   
> @@ -17,11 +19,21 @@
>       <unix:state state_ref="state_file_group_owner_grub_conf" />
>     </unix:file_test>
>   
> +  <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="test_file_group_owner_efi_grub_conf" version="1">
> +    <unix:object object_ref="object_file_group_owner_efi_grub_conf" />
> +    <unix:state state_ref="state_file_group_owner_grub_conf" />
> +  </unix:file_test>
> +
>     <unix:file_object comment="/boot/grub/grub.conf" id="object_file_group_owner_grub_conf" version="1">
>       <unix:path>/boot/grub</unix:path>
>       <unix:filename>grub.conf</unix:filename>
>     </unix:file_object>
>   
> +  <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" id="object_file_group_owner_efi_grub_conf" version="1">
> +    <unix:path>/boot/efi/EFI/redhat</unix:path>
> +    <unix:filename>grub.conf</unix:filename>
> +  </unix:file_object>
> +
>     <unix:file_state id="state_file_group_owner_grub_conf" version="1">
>       <unix:group_id datatype="int">0</unix:group_id>
>     </unix:file_state>
> diff --git a/RHEL6/input/checks/file_user_owner_grub_conf.xml b/RHEL6/input/checks/file_user_owner_grub_conf.xml
> index 53d5e2f..290d883 100644
> --- a/RHEL6/input/checks/file_user_owner_grub_conf.xml
> +++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml
> @@ -1,14 +1,16 @@
>   <def-group>
>     <definition class="compliance" id="file_user_owner_grub_conf" version="1">
>       <metadata>
> -      <title>File /boot/grub/grub.conf Owned By root User</title>
> +      <title>File grub.conf Owned By root User</title>
>         <affected family="unix">
>           <platform>Red Hat Enterprise Linux 6</platform>
>         </affected>
> -      <description>The /boot/grub/grub.conf file should be owned by the root user.</description>
> +      <description>The grub.conf file should be owned by the root user.</description>
> +      <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
>       </metadata>
> -    <criteria>
> +    <criteria operator="OR">
>         <criterion test_ref="test_file_user_owner_grub_conf" />
> +      <criterion test_ref="test_file_user_owner_efi_grub_conf" />
>       </criteria>
>     </definition>
>   
> @@ -17,11 +19,21 @@
>       <unix:state state_ref="state_file_user_owner_grub_conf" />
>     </unix:file_test>
>   
> +  <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="test_file_user_owner_efi_grub_conf" version="1">
> +    <unix:object object_ref="object_file_user_owner_efi_grub_conf" />
> +    <unix:state state_ref="state_file_user_owner_grub_conf" />
> +  </unix:file_test>
> +
>     <unix:file_object comment="/boot/grub/grub.conf" id="object_file_user_owner_grub_conf" version="1">
>       <unix:path>/boot/grub</unix:path>
>       <unix:filename>grub.conf</unix:filename>
>     </unix:file_object>
>   
> +  <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" id="object_file_user_owner_efi_grub_conf" version="1">
> +    <unix:path>/boot/efi/EFI/redhat</unix:path>
> +    <unix:filename>grub.conf</unix:filename>
> +  </unix:file_object>
> +
>     <unix:file_state id="state_file_user_owner_grub_conf" version="1">
>       <unix:user_id datatype="int">0</unix:user_id>
>     </unix:file_state>



More information about the scap-security-guide mailing list