[PATCH 01/22] XCCDF & OVAL signoff for file_ownership_library_dirs + remediation

Shawn Wells shawn.d.wells at gmail.com
Mon Sep 16 01:30:38 UTC 2013


-------------- next part --------------
>From 8941c2ab2f3d45f41d71eaf8c6140615194049c4 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Wed, 11 Sep 2013 18:46:16 -0400
Subject: [PATCH 01/22] XCCDF & OVAL signoff for file_ownership_library_dirs + remediation
 - The XCCDF was not clear that users should scan the /lib/modules directory, adjusted wording
 - XCCDF find command was wrong (didn't check ownership of directories)
 - OVAL signoff
 - Added remediation, based off Leam's work in Aqueduct

TESTING:
[root at SSG-RHEL6 checks]# ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirsMpn3Lp.xml
Writing results to : /tmp/file_ownership_library_dirsMpn3Lp.xml-results
Definition oval:scap-security-guide.testing:def:109: true
Evaluation done.
[root at SSG-RHEL6 checks]# chown shawn /lib
[root at SSG-RHEL6 checks]# ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirs_UazcB.xml
Writing results to : /tmp/file_ownership_library_dirs_UazcB.xml-results
Definition oval:scap-security-guide.testing:def:109: false
Evaluation done.
[root at SSG-RHEL6 checks]# bash ../fixes/bash/file_ownership_library_dirs.sh
[root at SSG-RHEL6 checks]# ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirst99cvy.xml
Writing results to : /tmp/file_ownership_library_dirst99cvy.xml-results
Definition oval:scap-security-guide.testing:def:109: true
Evaluation done.
---
 RHEL6/input/checks/file_ownership_library_dirs.xml |    1 +
 .../fixes/bash/file_ownership_library_dirs.sh      |    7 +++++++
 RHEL6/input/system/permissions/files.xml           |   10 ++++++----
 3 files changed, 14 insertions(+), 4 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/file_ownership_library_dirs.sh

diff --git a/RHEL6/input/checks/file_ownership_library_dirs.xml b/RHEL6/input/checks/file_ownership_library_dirs.xml
index 1a4da0a..e3e66d2 100644
--- a/RHEL6/input/checks/file_ownership_library_dirs.xml
+++ b/RHEL6/input/checks/file_ownership_library_dirs.xml
@@ -6,6 +6,7 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and objects therein, are owned by root</description>
+      <reference source="swells" ref_id="20130914" ref_url="test_attestation" />
     </metadata>
     <criteria operator="AND">
       <criterion test_ref="test_ownership_lib_dir" />
diff --git a/RHEL6/input/fixes/bash/file_ownership_library_dirs.sh b/RHEL6/input/fixes/bash/file_ownership_library_dirs.sh
new file mode 100644
index 0000000..b85a2c4
--- /dev/null
+++ b/RHEL6/input/fixes/bash/file_ownership_library_dirs.sh
@@ -0,0 +1,7 @@
+for LIBDIR in /usr/lib /usr/lib64 /lib /lib64
+do
+  if [ -d $LIBDIR ]
+  then
+    find -L $LIBDIR \! -user root -exec chown root {} \; 
+  fi
+done
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index 53bc801..405307e 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -231,9 +231,9 @@ by default:
 </pre>
 Kernel modules, which can be added to the kernel during runtime, are also
 stored in <tt>/lib/modules</tt>. All files in these directories should be
-owned by the <tt>root</tt> user. If any file in these directories is found
-to be owned by a user other than root, correct its ownership with the
-following command:
+owned by the <tt>root</tt> user. If the directory, or any file in these
+directories, is found to be owned by a user other than root correct its
+ownership with the following command:
 <pre># chown root <i>FILE</i></pre>
 </description>
 <ocil clause="any of these files are not owned by root">
@@ -242,10 +242,11 @@ Shared libraries are stored in the following directories:
 /lib64
 /usr/lib
 /usr/lib64
+Additionlly, kernel modules are stored in <tt>/lib/modules</tt>.
 </pre>
 For each of these directories, run the following command to find files not 
 owned by root:
-<pre>$ find <i>DIR</i> \! -user root -type f</pre>
+<pre># find -L <i>$DIR</i> \! -user root -exec chown root {} \;</pre>
 </ocil>
 <rationale>Files from shared library directories are loaded into the address
 space of processes (including privileged ones) or of the kernel itself at
@@ -253,6 +254,7 @@ runtime. Proper ownership is necessary to protect the integrity of the system.
 </rationale>
 <ref nist="AC-6" disa="1499"/>
 <oval id="file_ownership_library_dirs" />
+<tested by="swells" on="20130914"/>
 </Rule>
 
 
-- 
1.7.1



More information about the scap-security-guide mailing list