[PATCH 01/22] XCCDF & OVAL signoff for file_ownership_library_dirs + remediation
Shawn Wells
shawn.d.wells at gmail.com
Mon Sep 16 01:30:38 UTC 2013
-------------- next part --------------
>From 8941c2ab2f3d45f41d71eaf8c6140615194049c4 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Wed, 11 Sep 2013 18:46:16 -0400
Subject: [PATCH 01/22] XCCDF & OVAL signoff for file_ownership_library_dirs + remediation
- The XCCDF was not clear that users should scan the /lib/modules directory, adjusted wording
- XCCDF find command was wrong (didn't check ownership of directories)
- OVAL signoff
- Added remediation, based off Leam's work in Aqueduct
TESTING:
[root at SSG-RHEL6 checks]# ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirsMpn3Lp.xml
Writing results to : /tmp/file_ownership_library_dirsMpn3Lp.xml-results
Definition oval:scap-security-guide.testing:def:109: true
Evaluation done.
[root at SSG-RHEL6 checks]# chown shawn /lib
[root at SSG-RHEL6 checks]# ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirs_UazcB.xml
Writing results to : /tmp/file_ownership_library_dirs_UazcB.xml-results
Definition oval:scap-security-guide.testing:def:109: false
Evaluation done.
[root at SSG-RHEL6 checks]# bash ../fixes/bash/file_ownership_library_dirs.sh
[root at SSG-RHEL6 checks]# ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirst99cvy.xml
Writing results to : /tmp/file_ownership_library_dirst99cvy.xml-results
Definition oval:scap-security-guide.testing:def:109: true
Evaluation done.
---
RHEL6/input/checks/file_ownership_library_dirs.xml | 1 +
.../fixes/bash/file_ownership_library_dirs.sh | 7 +++++++
RHEL6/input/system/permissions/files.xml | 10 ++++++----
3 files changed, 14 insertions(+), 4 deletions(-)
create mode 100644 RHEL6/input/fixes/bash/file_ownership_library_dirs.sh
diff --git a/RHEL6/input/checks/file_ownership_library_dirs.xml b/RHEL6/input/checks/file_ownership_library_dirs.xml
index 1a4da0a..e3e66d2 100644
--- a/RHEL6/input/checks/file_ownership_library_dirs.xml
+++ b/RHEL6/input/checks/file_ownership_library_dirs.xml
@@ -6,6 +6,7 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and objects therein, are owned by root</description>
+ <reference source="swells" ref_id="20130914" ref_url="test_attestation" />
</metadata>
<criteria operator="AND">
<criterion test_ref="test_ownership_lib_dir" />
diff --git a/RHEL6/input/fixes/bash/file_ownership_library_dirs.sh b/RHEL6/input/fixes/bash/file_ownership_library_dirs.sh
new file mode 100644
index 0000000..b85a2c4
--- /dev/null
+++ b/RHEL6/input/fixes/bash/file_ownership_library_dirs.sh
@@ -0,0 +1,7 @@
+for LIBDIR in /usr/lib /usr/lib64 /lib /lib64
+do
+ if [ -d $LIBDIR ]
+ then
+ find -L $LIBDIR \! -user root -exec chown root {} \;
+ fi
+done
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index 53bc801..405307e 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -231,9 +231,9 @@ by default:
</pre>
Kernel modules, which can be added to the kernel during runtime, are also
stored in <tt>/lib/modules</tt>. All files in these directories should be
-owned by the <tt>root</tt> user. If any file in these directories is found
-to be owned by a user other than root, correct its ownership with the
-following command:
+owned by the <tt>root</tt> user. If the directory, or any file in these
+directories, is found to be owned by a user other than root correct its
+ownership with the following command:
<pre># chown root <i>FILE</i></pre>
</description>
<ocil clause="any of these files are not owned by root">
@@ -242,10 +242,11 @@ Shared libraries are stored in the following directories:
/lib64
/usr/lib
/usr/lib64
+Additionlly, kernel modules are stored in <tt>/lib/modules</tt>.
</pre>
For each of these directories, run the following command to find files not
owned by root:
-<pre>$ find <i>DIR</i> \! -user root -type f</pre>
+<pre># find -L <i>$DIR</i> \! -user root -exec chown root {} \;</pre>
</ocil>
<rationale>Files from shared library directories are loaded into the address
space of processes (including privileged ones) or of the kernel itself at
@@ -253,6 +254,7 @@ runtime. Proper ownership is necessary to protect the integrity of the system.
</rationale>
<ref nist="AC-6" disa="1499"/>
<oval id="file_ownership_library_dirs" />
+<tested by="swells" on="20130914"/>
</Rule>
--
1.7.1
More information about the scap-security-guide
mailing list