[PATCH 4/8] OVAL signoff file_permissions_library_dirs
Shawn Wells
shawn.d.wells at gmail.com
Sun Sep 29 00:16:09 UTC 2013
-------------- next part --------------
>From 620110f0d39ba03d361d0be77cdde934cf387953 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 28 Sep 2013 14:46:01 -0400
Subject: [PATCH 4/8] OVAL signoff: file_permissions_library_dirs
Light OVAL cleanup & signoff
TESTING:
[shawn at SSG-RHEL6 checks]$ ./testcheck.py file_permissions_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirsFTuNR_.xml
Writing results to : /tmp/file_permissions_library_dirsFTuNR_.xml-results
Definition oval:scap-security-guide.testing:def:207: true
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo chmod go+w /lib/modules/2.6.32-358.el6.x86_64/modules.alias.bin ; \
> ./testcheck.py file_permissions_library_dirs.xml ; \
> sudo chmod go+w /lib/modules/2.6.32-358.el6.x86_64/modules.alias.bin
[sudo] password for shawn:
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirsxXAggX.xml
Writing results to : /tmp/file_permissions_library_dirsxXAggX.xml-results
Definition oval:scap-security-guide.testing:def:207: false
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo chmod go-w /lib/modules/2.6.32-358.el6.x86_64/modules.alias.bin ; \
> sudo chmod go+w /lib64/libcrypt-2.12.so ; \
> ./testcheck.py file_permissions_library_dirs.xml ; \
> sudo chmod go-w /lib64/libcrypt-2.12.so
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirsXRlOwe.xml
Writing results to : /tmp/file_permissions_library_dirsXRlOwe.xml-results
Definition oval:scap-security-guide.testing:def:207: false
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo chmod go+w /usr/lib/rpm/rpm.log ; \
> ./testcheck.py file_permissions_library_dirs.xml ;
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirsuIDtZJ.xml
Writing results to : /tmp/file_permissions_library_dirsuIDtZJ.xml-results
Definition oval:scap-security-guide.testing:def:207: false
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo chmod go-w /usr/lib/rpm/rpm.log ; \
> sudo chmod go+w /usr/lib64/gio/modules/libgiofam.so ; \
> ./testcheck.py file_permissions_library_dirs.xml ;
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirs4d3K_q.xml
Writing results to : /tmp/file_permissions_library_dirs4d3K_q.xml-results
Definition oval:scap-security-guide.testing:def:207: false
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo chmod go-w /usr/lib64/gio/modules/libgiofam.so ; \
> ./testcheck.py file_permissions_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirsRxChxs.xml
Writing results to : /tmp/file_permissions_library_dirsRxChxs.xml-results
Definition oval:scap-security-guide.testing:def:207: true
Evaluation done.
---
.../input/checks/file_permissions_library_dirs.xml | 45 ++++++-------------
1 files changed, 14 insertions(+), 31 deletions(-)
diff --git a/RHEL6/input/checks/file_permissions_library_dirs.xml b/RHEL6/input/checks/file_permissions_library_dirs.xml
index bcb6ce9..0005b8c 100644
--- a/RHEL6/input/checks/file_permissions_library_dirs.xml
+++ b/RHEL6/input/checks/file_permissions_library_dirs.xml
@@ -7,30 +7,30 @@
</affected>
<description>Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and objects therein, are not group-writable
or world-writable.</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
</metadata>
<criteria operator="AND">
<criterion test_ref="test_perms_lib_dir" />
<criterion test_ref="test_perms_lib64_dir" />
<criterion test_ref="test_perms_usr_lib_dir" />
<criterion test_ref="test_perms_usr_lib64_dir" />
- <criterion test_ref="test_perms_lib_modules_dir" />
<criterion test_ref="test_perms_lib_files" />
<criterion test_ref="test_perms_lib64_files" />
<criterion test_ref="test_perms_usr_lib_files" />
<criterion test_ref="test_perms_usr_lib64_files" />
- <criterion test_ref="test_perms_lib_modules_files" />
</criteria>
</definition>
+<!-- /lib directory and file tests -->
<unix:file_test check="all" check_existence="none_exist" comment="/lib directories go-w" id="test_perms_lib_dir" version="1">
- <unix:object object_ref="object_file_permissions_library_dir" />
+ <unix:object object_ref="object_file_permissions_lib_dir" />
</unix:file_test>
<unix:file_test check="all" check_existence="none_exist" comment="/lib files go-w" id="test_perms_lib_files" version="1">
<unix:object object_ref="object_file_permissions_lib_files" />
</unix:file_test>
- <unix:file_object comment="/lib directories" id="object_file_permissions_library_dir" version="1">
+ <unix:file_object comment="/lib directories" id="object_file_permissions_lib_dir" version="1">
<unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
<unix:path operation="equals">/lib</unix:path>
<unix:filename xsi:nil="true" />
@@ -45,7 +45,9 @@
<filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
<filter action="exclude">state_symlink</filter>
</unix:file_object>
+<!-- end /lib directory and file tests -->
+<!-- /lib64 directory and file tests -->
<unix:file_test check="all" check_existence="none_exist" comment="/lib64 directories go-w" id="test_perms_lib64_dir" version="1">
<unix:object object_ref="object_file_permissions_lib64_dir" />
</unix:file_test>
@@ -69,7 +71,9 @@
<filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
<filter action="exclude">state_symlink</filter>
</unix:file_object>
+<!-- /lib64 directory and file tests -->
+<!-- /usr/lib directory and file tests -->
<unix:file_test check="all" check_existence="none_exist" comment="/usr/lib directories go-w" id="test_perms_usr_lib_dir" version="1">
<unix:object object_ref="object_file_permissions_usr_lib_dir" />
</unix:file_test>
@@ -92,8 +96,10 @@
<unix:filename operation="pattern match">^.*$</unix:filename>
<filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
<filter action="exclude">state_symlink</filter>
- </unix:file_object>
+ </unix:file_object>
+<!-- /usr/lib directory and file tests -->
+<!-- /usr/lib64 directory and file tests -->
<unix:file_test check="all" check_existence="none_exist" comment="/usr/lib64 directories go-w" id="test_perms_usr_lib64_dir" version="1">
<unix:object object_ref="object_file_permissions_usr_lib64_dir" />
</unix:file_test>
@@ -101,14 +107,14 @@
<unix:file_test check="all" check_existence="none_exist" comment="/usr/lib64 files go-w" id="test_perms_usr_lib64_files" version="1">
<unix:object object_ref="object_file_permissions_usr_lib64_files" />
</unix:file_test>
-
+
<unix:file_object comment="/usr/lib64 directories" id="object_file_permissions_usr_lib64_dir" version="1">
<unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
<unix:path operation="equals">/usr/lib64</unix:path>
<unix:filename xsi:nil="true" />
<filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
<filter action="exclude">state_symlink</filter>
- </unix:file_object>
+ </unix:file_object>
<unix:file_object comment="/usr/lib64 files" id="object_file_permissions_usr_lib64_files" version="1">
<unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
@@ -117,30 +123,7 @@
<filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
<filter action="exclude">state_symlink</filter>
</unix:file_object>
-
- <unix:file_test check="all" check_existence="none_exist" comment="/lib/modules directories go-w" id="test_perms_lib_modules_dir" version="1">
- <unix:object object_ref="object_file_permissions_lib_modules" />
- </unix:file_test>
-
- <unix:file_test check="all" check_existence="none_exist" comment="/lib/modules files go-w" id="test_perms_lib_modules_files" version="1">
- <unix:object object_ref="object_file_permissions_lib_modules_files" />
- </unix:file_test>
-
- <unix:file_object comment="/lib/modules directories" id="object_file_permissions_lib_modules" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
- <unix:path operation="equals">/lib/modules</unix:path>
- <unix:filename xsi:nil="true" />
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
- <filter action="exclude">state_symlink</filter>
- </unix:file_object>
-
- <unix:file_object comment="/lib/modules files" id="object_file_permissions_lib_modules_files" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
- <unix:path operation="equals">/lib/modules</unix:path>
- <unix:filename operation="pattern match">^.*$</unix:filename>
- <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
- <filter action="exclude">state_symlink</filter>
- </unix:file_object>
+<!-- /usr/lib64 directory and file tests -->
<unix:file_state id="state_symlink" version="1">
<unix:type operation="equals">symbolic link</unix:type>
--
1.7.1
More information about the scap-security-guide
mailing list