[PATCH 18/22] Added remediation for umask_for_daemons
Shawn Wells
shawn.d.wells at gmail.com
Mon Sep 16 01:33:51 UTC 2013
-------------- next part --------------
>From 76a0a21fc9e537865bd9141cd6d8f66d01fa2bf3 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 15 Sep 2013 19:43:54 -0400
Subject: [PATCH 18/22] Added remediation for umask_for_daemons
- OVAL/XCCDF namings
- Added remediation script
---
RHEL6/input/fixes/bash/umask_for_daemons.sh | 8 ++++++++
RHEL6/input/profiles/CS2.xml | 2 +-
RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +-
RHEL6/input/profiles/nist-CL-IL-AL.xml | 2 +-
RHEL6/input/profiles/stig-rhel6-server.xml | 2 +-
RHEL6/input/profiles/test.xml | 2 +-
RHEL6/input/profiles/usgcb-rhel6-server.xml | 2 +-
RHEL6/input/system/permissions/execution.xml | 2 +-
8 files changed, 15 insertions(+), 7 deletions(-)
create mode 100644 RHEL6/input/fixes/bash/umask_for_daemons.sh
diff --git a/RHEL6/input/fixes/bash/umask_for_daemons.sh b/RHEL6/input/fixes/bash/umask_for_daemons.sh
new file mode 100644
index 0000000..bce47aa
--- /dev/null
+++ b/RHEL6/input/fixes/bash/umask_for_daemons.sh
@@ -0,0 +1,8 @@
+source ./templates/support.sh
+populate var_umask_for_daemons
+
+grep -q ^umask /etc/init.d/functions && \
+ sed -i "s/umask.*/umask $var_umask_for_daemons/g" /etc/init.d/functions
+if ! [ $? -eq 0 ]; then
+ echo "umask $var_umask_for_daemons" >> /etc/init.d/functions
+fi
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index 57651e7..9e703fc 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -66,7 +66,7 @@
<select idref="no_files_unowned_by_group" selected="true" />
<select idref="world_writable_files_system_ownership" selected="true" />
-<select idref="set_daemon_umask" selected="true" />
+<select idref="umask_for_daemons" selected="true" />
<refine-value idref="var_umask_for_daemons" selector="027"/>
<select idref="disable_users_coredumps" selected="true"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index afe5f47..18911ad 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -38,7 +38,7 @@
<!-- AC-6 -->
<refine-value idref="var_umask_for_daemons" selector="022"/>
<select idref="sshd_disable_root_login" selected="true" />
-<select idref="set_daemon_umask" selected="true" />
+<select idref="umask_for_daemons" selected="true" />
<select idref="userowner_shadow_file" selected="true" />
<select idref="groupowner_shadow_file" selected="true" />
<select idref="perms_shadow_file" selected="true"/>
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 28e65dc..bb920f6 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -155,7 +155,7 @@ assurance."</description>
<select idref="no_files_unowned_by_user" selected="true" \>
<select idref="no_files_unowned_by_group" selected="true" \>
<select idref="world_writable_files_system_ownership" selected="true" \>
-<select idref="set_daemon_umask" selected="true" \>
+<select idref="umask_for_daemons" selected="true" \>
<select idref="no_uidzero_except_root" selected="true" \>
<select idref="userowner_rsyslog_files" selected="true" \>
<select idref="groupowner_rsyslog_files" selected="true" \>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index 2e95ec9..62aafe6 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -70,7 +70,7 @@
<select idref="user_umask_logindefs" selected="true" />
<refine-value idref="var_accounts_user_umask" selector="077" />
-<select idref="set_daemon_umask" selected="true" />
+<select idref="umask_for_daemons" selected="true" />
<refine-value idref="var_umask_for_daemons" selector="027"/>
diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml
index a729046..f460ebb 100644
--- a/RHEL6/input/profiles/test.xml
+++ b/RHEL6/input/profiles/test.xml
@@ -49,7 +49,7 @@
<select idref="user_umask_logindefs" selected="true" />
<refine-value idref="var_accounts_user_umask" selector="077" />
-<select idref="set_daemon_umask" selected="true"/>
+<select idref="umask_for_daemons" selected="true"/>
<refine-value idref="var_umask_for_daemons" selector="027"/>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 246931c..bdd5c08 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -55,7 +55,7 @@
<select idref="no_files_unowned_by_group" selected="true" />
<select idref="world_writable_files_system_ownership" selected="true" />
<refine-value idref="var_umask_for_daemons" selector="027"/>
-<select idref="set_daemon_umask" selected="true" />
+<select idref="umask_for_daemons" selected="true" />
<select idref="disable_setuid_coredumps" selected="true" />
<select idref="disable_users_coredumps" selected="true" />
<select idref="enable_randomize_va_space" selected="true" />
diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
index 0e2fb5d..e15f7ff 100644
--- a/RHEL6/input/system/permissions/execution.xml
+++ b/RHEL6/input/system/permissions/execution.xml
@@ -23,7 +23,7 @@ for system daemons.
<value selector="027">027</value>
</Value>
-<Rule id="set_daemon_umask">
+<Rule id="umask_for_daemons">
<title>Set Daemon Umask</title>
<description>The file <tt>/etc/init.d/functions</tt> includes initialization
parameters for most or all daemons started at boot time. The default umask of
--
1.7.1
More information about the scap-security-guide
mailing list