[PATCH] [RHEL/6] accounts_umask_etc_profile - when checking umask check all the occurrences not just the first one (because the last listed one is actually the one applied)

Shawn Wells shawn at redhat.com
Fri Apr 18 03:54:27 UTC 2014


On 4/16/14, 9:43 AM, Jan Lieskovsky wrote:
> Patch summary:
>    The current implementation of accounts_umask_etc_profile check is checking
> just the first occurrence of umask keyword in /etc/profile file. But the last
> occurrence is the one that's actually applied. This can be checked via having:
>
> umask 077
> umask 022
>
> in /etc/profile, login to a new log-in session for particular user (su - $USER),
> and running "umask" command without arguments (the last setting, e.g. 0022 is reported as
> the actual umask value used for file creation. Can be verified by checking mode
> of newly created file in that session).
>
>    So instead of checking just first value (and possibly reporting false-negative
> test result), check all occurrences (and report proper result).
>
> Testing report:
>    The patch has been tested on RHEL-6 & works properly.
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> 0001-RHEL-6-accounts_umask_etc_profile-when-checking-umas.patch
>
>
>  From e32b7d5800d16f40e46d6448c6fc64c7f2887d1a Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Wed, 16 Apr 2014 18:29:28 +0200
> Subject: [PATCH] [RHEL/6] accounts_umask_etc_profile - when checking umask
>   check all the          occurrences not just the first one (because the last
>   listed one          is actually the one applied)
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   RHEL/6/input/checks/accounts_umask_etc_profile.xml | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/RHEL/6/input/checks/accounts_umask_etc_profile.xml b/RHEL/6/input/checks/accounts_umask_etc_profile.xml
> index 18e1226..5789d4a 100644
> --- a/RHEL/6/input/checks/accounts_umask_etc_profile.xml
> +++ b/RHEL/6/input/checks/accounts_umask_etc_profile.xml
> @@ -9,7 +9,7 @@
>         </affected>
>         <description>The default umask for all users should be set
>         correctly</description>
> -      <reference source="MED" ref_id="20130807" ref_url="test_attestation" />
> +      <reference source="JL" ref_id="20140416" ref_url="test_attestation" />
>       </metadata>
>       <criteria>
>         <criterion test_ref="test_accounts_umask_etc_profile" />
> @@ -27,9 +27,9 @@
>     </ind:textfilecontent54_state>
>     <external_variable comment="user umask" datatype="string" id="var_accounts_user_umask" version="1" />
>     <ind:textfilecontent54_object id="obj_accounts_umask_etc_profile"
> -  version="1">
> +  version="2">
>       <ind:filepath>/etc/profile</ind:filepath>
>       <ind:pattern operation="pattern match">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
> -    <ind:instance datatype="int">1</ind:instance>
> +    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
>     </ind:textfilecontent54_object>
>   </def-group>
> -- 1.8.3.1

My original thought process was "what if /etc/profile has if statements, 
selecting different umasks for certain situations?"..... but really, the 
deployment should never have a lesser umask. Changing the instance 
operation to >= makes sense.

ack

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140417/2c370a41/attachment.html>


More information about the scap-security-guide mailing list