[PATCH] grub.conf is not guaranteed to be in /boot/grub if the system is using EFI, so I added a test for its default location in /boot/efi/EFI/redhat

Maura Dailey maura at eclipse.ncsc.mil
Tue Sep 10 19:31:52 UTC 2013


|How's this?

I haven't submitted a check for the file permissions check yet, because 
I need to discuss the fact that EFI's grub.conf is going to be 700, not 
600. A side effect of VFAT, I suppose.
||
- Maura Dailey

||Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>||
||---||
|| RHEL6/input/checks/file_group_owner_grub_conf.xml | 20 
+++++++++++++++-----||
|| RHEL6/input/checks/file_user_owner_grub_conf.xml  | 20 
+++++++++++++++-----||
|| 2 files changed, 30 insertions(+), 10 deletions(-)||
||
||diff --git a/RHEL6/input/checks/file_group_owner_grub_conf.xml 
b/RHEL6/input/checks/file_group_owner_grub_conf.xml||
||index 3fc076a..6d54f69 100644||
||--- a/RHEL6/input/checks/file_group_owner_grub_conf.xml||
||+++ b/RHEL6/input/checks/file_group_owner_grub_conf.xml||
||@@ -1,14 +1,16 @@||
|| <def-group>||
||   <definition class="compliance" id="file_group_owner_grub_conf" 
version="1">||
||     <metadata>||
||-      <title>File /boot/grub/grub.conf Owned By root Group </title>||
||+      <title>File grub.conf Owned By root Group </title>||
||       <affected family="unix">||
||         <platform>Red Hat Enterprise Linux 6</platform>||
||       </affected>||
||-      <description>The /boot/grub/grub.conf file should be owned by 
the root group.</description>||
||+      <description>The grub.conf file should be owned by the root 
group. By default, this file is located at /boot/grub/grub.conf or, for 
EFI systems, at /boot/efi/EFI/redhat/grub.conf</description>||
||+      <reference source="MED" ref_id="20130830" 
ref_url="test_attestation" />||
||     </metadata>||
||-    <criteria>||
||+    <criteria operator="OR">||
||       <criterion test_ref="test_file_group_owner_grub_conf" />||
||+      <criterion test_ref="test_file_group_owner_efi_grub_conf" />||
||     </criteria>||
||   </definition>||
||||
||@@ -17,9 +19,17 @@||
||     <unix:state state_ref="state_file_group_owner_grub_conf" />||
||   </unix:file_test>||
||||
||+  <unix:file_test check="all" check_existence="all_exist" 
comment="/boot/efi/EFI/redhat/grub.conf owned by root" 
id="test_file_group_owner_efi_grub_conf" version="1">||
||+    <unix:object object_ref="object_file_group_owner_efi_grub_conf" />||
||+    <unix:state state_ref="state_file_group_owner_grub_conf" />||
||+  </unix:file_test>||
||+||
||   <unix:file_object comment="/boot/grub/grub.conf" 
id="object_file_group_owner_grub_conf" version="1">||
||-    <unix:path>/boot/grub</unix:path>||
||- <unix:filename>grub.conf</unix:filename>||
||+ <unix:filepath>/boot/grub/grub.conf</unix:filepath>||
||+  </unix:file_object>||
||+||
||+  <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" 
id="object_file_group_owner_efi_grub_conf" version="1">||
||+ <unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath>||
||   </unix:file_object>||
||||
||   <unix:file_state id="state_file_group_owner_grub_conf" version="1">||
||diff --git a/RHEL6/input/checks/file_user_owner_grub_conf.xml 
b/RHEL6/input/checks/file_user_owner_grub_conf.xml||
||index 53d5e2f..0a3df12 100644||
||--- a/RHEL6/input/checks/file_user_owner_grub_conf.xml||
||+++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml||
||@@ -1,14 +1,16 @@||
|| <def-group>||
||   <definition class="compliance" id="file_user_owner_grub_conf" 
version="1">||
||     <metadata>||
||-      <title>File /boot/grub/grub.conf Owned By root User</title>||
||+      <title>File grub.conf Owned By root User</title>||
||       <affected family="unix">||
||         <platform>Red Hat Enterprise Linux 6</platform>||
||       </affected>||
||-      <description>The /boot/grub/grub.conf file should be owned by 
the root user.</description>||
||+      <description>The grub.conf file should be owned by the root 
user. By default, this file is located at /boot/grub/grub.conf or, for 
EFI systems, at /boot/efi/EFI/redhat/grub.conf</description>||
||+      <reference source="MED" ref_id="20130830" 
ref_url="test_attestation" />||
||     </metadata>||
||-    <criteria>||
||+    <criteria operator="OR">||
||       <criterion test_ref="test_file_user_owner_grub_conf" />||
||+      <criterion test_ref="test_file_user_owner_efi_grub_conf" />||
||     </criteria>||
||   </definition>||
||||
||@@ -17,9 +19,17 @@||
||     <unix:state state_ref="state_file_user_owner_grub_conf" />||
||   </unix:file_test>||
||||
||+  <unix:file_test check="all" check_existence="all_exist" 
comment="/boot/efi/EFI/redhat/grub.conf owned by root" 
id="test_file_user_owner_efi_grub_conf" version="1">||
||+    <unix:object object_ref="object_file_user_owner_efi_grub_conf" />||
||+    <unix:state state_ref="state_file_user_owner_grub_conf" />||
||+  </unix:file_test>||
||+||
||   <unix:file_object comment="/boot/grub/grub.conf" 
id="object_file_user_owner_grub_conf" version="1">||
||-    <unix:path>/boot/grub</unix:path>||
||- <unix:filename>grub.conf</unix:filename>||
||+ <unix:filepath>/boot/grub/grub.conf</unix:filepath>||
||+  </unix:file_object>||
||+||
||+  <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" 
id="object_file_user_owner_efi_grub_conf" version="1">||
||+ <unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath>||
||   </unix:file_object>||
||||
||   <unix:file_state id="state_file_user_owner_grub_conf" version="1">||
||-- ||
||1.7.1||
|
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130910/5827cfe3/attachment-0001.html>


More information about the scap-security-guide mailing list