[PATCH 4/8] OVAL signoff file_permissions_library_dirs

Shawn Wells shawn.d.wells at gmail.com
Sun Sep 29 00:16:09 UTC 2013


-------------- next part --------------
>From 620110f0d39ba03d361d0be77cdde934cf387953 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 28 Sep 2013 14:46:01 -0400
Subject: [PATCH 4/8] OVAL signoff: file_permissions_library_dirs
 Light OVAL cleanup & signoff

TESTING:
[shawn at SSG-RHEL6 checks]$ ./testcheck.py file_permissions_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirsFTuNR_.xml
Writing results to : /tmp/file_permissions_library_dirsFTuNR_.xml-results
Definition oval:scap-security-guide.testing:def:207: true
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo chmod go+w /lib/modules/2.6.32-358.el6.x86_64/modules.alias.bin ; \
> ./testcheck.py file_permissions_library_dirs.xml ; \
> sudo chmod go+w /lib/modules/2.6.32-358.el6.x86_64/modules.alias.bin
[sudo] password for shawn:
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirsxXAggX.xml
Writing results to : /tmp/file_permissions_library_dirsxXAggX.xml-results
Definition oval:scap-security-guide.testing:def:207: false
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo chmod go-w /lib/modules/2.6.32-358.el6.x86_64/modules.alias.bin ; \
> sudo chmod go+w /lib64/libcrypt-2.12.so ; \
> ./testcheck.py file_permissions_library_dirs.xml ; \
> sudo chmod go-w /lib64/libcrypt-2.12.so
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirsXRlOwe.xml
Writing results to : /tmp/file_permissions_library_dirsXRlOwe.xml-results
Definition oval:scap-security-guide.testing:def:207: false
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo chmod go+w /usr/lib/rpm/rpm.log ; \
> ./testcheck.py file_permissions_library_dirs.xml ;
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirsuIDtZJ.xml
Writing results to : /tmp/file_permissions_library_dirsuIDtZJ.xml-results
Definition oval:scap-security-guide.testing:def:207: false
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo chmod go-w /usr/lib/rpm/rpm.log  ; \
> sudo chmod go+w /usr/lib64/gio/modules/libgiofam.so  ; \
> ./testcheck.py file_permissions_library_dirs.xml ;
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirs4d3K_q.xml
Writing results to : /tmp/file_permissions_library_dirs4d3K_q.xml-results
Definition oval:scap-security-guide.testing:def:207: false
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo chmod go-w /usr/lib64/gio/modules/libgiofam.so ; \
> ./testcheck.py file_permissions_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_permissions_library_dirsRxChxs.xml
Writing results to : /tmp/file_permissions_library_dirsRxChxs.xml-results
Definition oval:scap-security-guide.testing:def:207: true
Evaluation done.
---
 .../input/checks/file_permissions_library_dirs.xml |   45 ++++++-------------
 1 files changed, 14 insertions(+), 31 deletions(-)

diff --git a/RHEL6/input/checks/file_permissions_library_dirs.xml b/RHEL6/input/checks/file_permissions_library_dirs.xml
index bcb6ce9..0005b8c 100644
--- a/RHEL6/input/checks/file_permissions_library_dirs.xml
+++ b/RHEL6/input/checks/file_permissions_library_dirs.xml
@@ -7,30 +7,30 @@
       </affected>
       <description>Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and objects therein, are not group-writable
       or world-writable.</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation" />
     </metadata>
     <criteria operator="AND">
       <criterion test_ref="test_perms_lib_dir" />
       <criterion test_ref="test_perms_lib64_dir" />
       <criterion test_ref="test_perms_usr_lib_dir" />
       <criterion test_ref="test_perms_usr_lib64_dir" />
-      <criterion test_ref="test_perms_lib_modules_dir" />
       <criterion test_ref="test_perms_lib_files" />
       <criterion test_ref="test_perms_lib64_files" />
       <criterion test_ref="test_perms_usr_lib_files" />
       <criterion test_ref="test_perms_usr_lib64_files" />
-      <criterion test_ref="test_perms_lib_modules_files" />
     </criteria>
   </definition>
 
+<!-- /lib directory and file tests -->
   <unix:file_test check="all" check_existence="none_exist" comment="/lib directories go-w" id="test_perms_lib_dir" version="1">
-    <unix:object object_ref="object_file_permissions_library_dir" />
+    <unix:object object_ref="object_file_permissions_lib_dir" />
   </unix:file_test>
 
   <unix:file_test check="all" check_existence="none_exist" comment="/lib files go-w" id="test_perms_lib_files" version="1">
     <unix:object object_ref="object_file_permissions_lib_files" />
   </unix:file_test>
 
-  <unix:file_object comment="/lib directories" id="object_file_permissions_library_dir" version="1">
+  <unix:file_object comment="/lib directories" id="object_file_permissions_lib_dir" version="1">
     <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
     <unix:path operation="equals">/lib</unix:path>
     <unix:filename xsi:nil="true" />
@@ -45,7 +45,9 @@
     <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
     <filter action="exclude">state_symlink</filter>
   </unix:file_object>
+<!-- end /lib directory and file tests -->
 
+<!-- /lib64 directory and file tests -->
   <unix:file_test check="all" check_existence="none_exist" comment="/lib64 directories go-w" id="test_perms_lib64_dir" version="1">
     <unix:object object_ref="object_file_permissions_lib64_dir" />
   </unix:file_test>
@@ -69,7 +71,9 @@
     <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
     <filter action="exclude">state_symlink</filter>
   </unix:file_object>
+<!-- /lib64 directory and file tests -->
 
+<!-- /usr/lib directory and file tests -->
   <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib directories go-w" id="test_perms_usr_lib_dir" version="1">
     <unix:object object_ref="object_file_permissions_usr_lib_dir" />
   </unix:file_test>
@@ -92,8 +96,10 @@
     <unix:filename operation="pattern match">^.*$</unix:filename>
     <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
     <filter action="exclude">state_symlink</filter>
-  </unix:file_object>  
+  </unix:file_object>
+<!-- /usr/lib directory and file tests -->
 
+<!-- /usr/lib64 directory and file tests -->
   <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib64 directories go-w" id="test_perms_usr_lib64_dir" version="1">
     <unix:object object_ref="object_file_permissions_usr_lib64_dir" />
   </unix:file_test>
@@ -101,14 +107,14 @@
   <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib64 files go-w" id="test_perms_usr_lib64_files" version="1">
     <unix:object object_ref="object_file_permissions_usr_lib64_files" />
   </unix:file_test>
-
+            
   <unix:file_object comment="/usr/lib64 directories" id="object_file_permissions_usr_lib64_dir" version="1">
     <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
     <unix:path operation="equals">/usr/lib64</unix:path>
     <unix:filename xsi:nil="true" />
     <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
     <filter action="exclude">state_symlink</filter>
-  </unix:file_object>
+  </unix:file_object>   
 
   <unix:file_object comment="/usr/lib64 files" id="object_file_permissions_usr_lib64_files" version="1">
     <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
@@ -117,30 +123,7 @@
     <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
     <filter action="exclude">state_symlink</filter>
   </unix:file_object>
-
-  <unix:file_test check="all" check_existence="none_exist" comment="/lib/modules directories go-w" id="test_perms_lib_modules_dir" version="1">
-    <unix:object object_ref="object_file_permissions_lib_modules" />
-  </unix:file_test>
-
-  <unix:file_test check="all" check_existence="none_exist" comment="/lib/modules files go-w" id="test_perms_lib_modules_files" version="1">
-    <unix:object object_ref="object_file_permissions_lib_modules_files" />
-  </unix:file_test>
-
-  <unix:file_object comment="/lib/modules directories" id="object_file_permissions_lib_modules" version="1">
-    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/lib/modules</unix:path>
-    <unix:filename xsi:nil="true" />
-    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
-    <filter action="exclude">state_symlink</filter>
-  </unix:file_object>
-
-  <unix:file_object comment="/lib/modules files" id="object_file_permissions_lib_modules_files" version="1">
-    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
-    <unix:path operation="equals">/lib/modules</unix:path>
-    <unix:filename operation="pattern match">^.*$</unix:filename>
-    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
-    <filter action="exclude">state_symlink</filter>
-  </unix:file_object>
+<!-- /usr/lib64 directory and file tests -->
 
   <unix:file_state id="state_symlink" version="1">
     <unix:type operation="equals">symbolic link</unix:type>
-- 
1.7.1



More information about the scap-security-guide mailing list